Microsoft issued a warning last week about CaptiveCrunch, a Russian campaign targeting corporate travelers on hotel and conference WiFi networks. The attack, attributed to Storm-2945 (a sub-cluster of Russia’s Midnight Blizzard), delivers a remote access trojan called CornFlake by compromising guest network captive portals and presenting fake Windows update prompts to unsuspecting users.
CornFlake is designed for comprehensive surveillance: it records keystrokes, collects files, steals credentials and session tokens, captures screenshots, and hijacks the device’s audio and video capabilities. Microsoft reports the campaign has been active since May 2026 and has impacted hospitality networks worldwide. The company advises travelers to avoid trusting guest networks, use mobile hotspots or cellular connections, and never install updates through captive portals.
That’s good advice. It will be ignored by most travelers who need to get work done in a hotel room after a long day.
Why the Attack Works
CaptiveCrunch succeeds because it exploits a moment of low vigilance. A traveler connects to hotel WiFi, sees a prompt that looks like a legitimate Windows update or security check, and clicks through. The fake portal delivers a malware payload disguised as an update file. The browser or network client writes the executable to disk, the user runs it (or it autoruns), and CornFlake activates. From that point forward, the attacker has persistent access to the device — even after the traveler leaves the hotel and reconnects to the corporate network.
The attack works because the delivery mechanism — a compromised captive portal presenting a fake update — is difficult for normal people to distinguish from legitimate network authentication. Microsoft notes that the pages “appear while users are connecting through a hotel or venue’s legitimate WiFi gateway, which makes it difficult for users to recognize.”
The Upstream Intervention
Here’s the technical reality: every RAT (Remote Access Trojan), including CornFlake, must write an executable file to disk before it can run. The malware doesn’t execute in the browser or in memory — it lands as a .exe, .dll, or .scr file on the Windows file system, and then it runs.
FileSure Defend operates at the kernel level via a filter driver that intercepts file system operations before they reach the disk. A simple rule blocks browsers, email clients, and other network-facing programs from writing executable file types to local drives. When a browser attempts to write CornFlake.exe (or whatever the payload is named) to the Downloads folder or temp directory, the kernel driver intercepts the write operation and blocks it. The file never lands. No file on disk means no execution, no surveillance, no credential theft, no lateral movement.
This is an upstream control. It doesn’t rely on signature detection, behavioral analysis after execution, or the user’s ability to spot a fake update prompt. It enforces a simple policy: programs that receive files from the network cannot write executable code to the hard drive. Period.
The FileSure Rule Configuration
A rule to prevent CaptiveCrunch delivery would look like this:
- File name filter:
*.exe;*.dll;*.scr;*.bat;*.cmd;*.vbs;*.ps1— executable and script file types - Program name filter:
\chrome.exe;\firefox.exe;\msedge.exe;\iexplore.exe— browsers commonly used on hotel WiFi, or use a wildcard exclusion approach that blocks all programs except authorized software update tools - Operations: Create, Write, Rename
- Drive type: Hard drives (local system drives)
- Action: Block
- Result: Any browser or network client attempting to write an executable file to the local drive is blocked at the kernel level. The payload never lands, so CornFlake never runs. The user may see an error or failed download, but the device remains uncompromised.
Self-updating programs (legitimate software with auto-update features) can be excluded by program name if needed, or updates can be delivered through a controlled internal mechanism rather than directly from the internet.
The Operational Reality
Microsoft’s advice to use mobile hotspots and avoid updates through captive portals is technically sound. It’s also operationally unrealistic for most corporate travelers. People will connect to hotel WiFi. They will see prompts that look legitimate. They will click through.
Kernel-level file operation control doesn’t depend on user behavior. It enforces policy regardless of what the user clicks, what the fake portal displays, or how convincing the social engineering is. The malware delivery fails because the write operation is blocked before the file system ever sees it.
If your organization has corporate travelers connecting to guest networks — and every organization does — you need a control that works when the user makes the wrong decision. Blocking executable writes at the kernel level is that control.
Start a free trial of FileSure Defend at bystorm.com and enforce file system security policies that stop malware delivery before it reaches the disk.
Source: Microsoft warns Windows PC users of Russian hackers on hotel WiFi
Category: Threat Intelligence
Tags: captivecrunch, cornflake rat, hotel wifi attack, storm-2945, malware delivery prevention, kernel filter driver, file system security, executable write blocking
