Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

A global campaign targeting hotel Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard, also known as APT29, which has been using custom malware to breach Microsoft 365 accounts. This campaign has significant implications, as APT29 is a known advanced persistent threat actor with a history of sophisticated attacks. The use of custom malware in these attacks allows the threat actor to evade detection and exploit vulnerabilities in Microsoft 365 accounts. The attacks on hotel Wi-Fi networks are particularly concerning, as they can provide a conduit for further attacks on business and government targets who use these networks while traveling. According to reports, this campaign signals evolving attack methods¹. This matters to practitioners because a breach involving APT29 can have downstream regulatory and supply-chain effects, making it essential to monitor for potential vulnerabilities and update security protocols accordingly.