APT29 CaptiveCrunch: LLMNR/DNS poisoning and captive-portal lures deliver CornFlake and ChocoShell; payloads blocked pre-execution
SentinelOne reports observing APT29 (Midnight Blizzard / Cozy Bear, Russia's SVR) running the CaptiveCrunch campaign, disclosed by Microsoft in July 2026, across multiple customer environments in three regions. The operation abuses captive-portal behaviour and forged name resolution to push fake browser updater downloads to roaming Window…