APT29 CaptiveCrunch: LLMNR/DNS poisoning and captive-portal lures deliver CornFlake and ChocoShell; payloads blocked pre-execution
SentinelOne reports observing APT29 (Midnight Blizzard / Cozy Bear, Russia's SVR) running the CaptiveCrunch campaign, disclosed by Microsoft in July 2026, across multiple customer environments in three regions. The operation abuses captive-portal behaviour and forged name resolution to push fake browser updater downloads to roaming Windows laptops. Unlike public accounts, which describe compromised captive-portal infrastructure, SentinelOne telemetry shows a Responder-style spoofer answering LLMNR queries on the victims' own network segment on roughly a third of affected hosts. The payloads were CornFlake (a Go RAT) and ChocoShell (an in-memory PowerShell infostealer). SentinelOne states its agent's on-device Static AI convicted every delivered payload before execution, even with the agent cut off from its cloud. The vendor also recorded 49 token requests to a poisoned Microsoft login domain, but cannot confirm their outcome.
Technical Details
- Delivery: the spoofer raced the legitimate resolver and rewrote only the terminal A record, replaying the genuine CNAME chain. Success rates ranged from 5.6% to 84% depending on the network.
- Lure: Windows' plain-HTTP connectivity check returned a forged reply, so the OS opened the default browser (Edge) at the adversary's page. The page served a browser updater matched to the victim's browser. SentinelOne saw manual download and launch, with no ClickFix-style lure on its endpoints. Manual launching is an inference, since Deep Visibility does not record mouse clicks.
- CornFlake capabilities: raw-input keylogger, clipboard monitoring, screenshots, microphone and webcam capture, USB monitoring. Persistence via services, Run keys and scheduled tasks, with a watchdog.
- ChocoShell capabilities: runs only in memory. It extracts live cookies from browser process memory and defeats Chrome App-Bound Encryption. It lifts Microsoft 365 and Entra ID tokens from the Token Broker cache. It disables AMSI via .NET reflection and runs a timing-based sandbox/VM check. It chains three UAC bypasses (SilentCleanup task, wsreset.exe, sdclt.exe).
- Token requests: 49 POSTs to the OAuth token endpoint were issued while the Microsoft login domain resolved to the adversary's address. On one endpoint they began about 24 hours before any payload. Roughly half of affected endpoints saw poisoning with no payload, suggesting the malware was not the sole objective.
- Detection outcome: Static AI convicted a partial .crdownload file and blocked launch in under 100 ms. SentinelOne reports 100% of delivered payloads were convicted in 100% of affected environments, with no execution from Downloads, no persistence, no post-incident C2 and no residual payload hashes.
- Hunt logic: group DNS answers by public IP, reduce queried names to eTLD+1, map to owning organisation and flag IPs answering for many unrelated owners. The adversary's address answered for about 135 domains across unrelated vendors including Adobe, Apple, Akamai, AnyDesk, BeyondTrust, Brother and Microsoft. This hunt surfaced nearly a third of confirmed endpoints that no alert had flagged. Weaker supporting signals:
- LLMNR responses carrying non-RFC1918 addresses.
- wpad. resolving to a non-RFC1918 address.
- The connectivity-check URL in a browser command line followed within 60 seconds by an executable or .crdownload in Downloads.
- Failed _ldap._tcp SRV lookups for your own domain controllers.
Remediation
- Disable LLMNR across managed estates, which removes the protocol the adversary answers on.
- Run the cross-vendor domain-per-IP hunt as a scheduled threat hunt, excluding CDNs by counting distinct domain owners rather than raw answers.
- For roaming staff with a suspected exposure window, review identity logs for sign-ins from unfamiliar infrastructure, anomalous token issuance and unexpected device registrations.
- Verify that endpoint protection can render a verdict locally when the network is hostile and the management console is unreachable.
Linha do tempo
-
APT29 CaptiveCrunch: LLMNR/DNS poisoning and captive-portal lures deliver CornFlake and ChocoShell; payloads blocked pre-execution
ler a análise desta fonte ocultar
SentinelOne reports observing APT29 (Midnight Blizzard / Cozy Bear, Russia's SVR) running the CaptiveCrunch campaign, disclosed by Microsoft in July 2026, across multiple customer environments in three regions. The operation abuses captive-portal behaviour and forged name resolution to push fake browser updater downloads to roaming Windows laptops. Unlike public accounts, which describe compromised captive-portal infrastructure, SentinelOne telemetry shows a Responder-style spoofer answering LLMNR queries on the victims' own network segment on roughly a third of affected hosts. The payloads were CornFlake (a Go RAT) and ChocoShell (an in-memory PowerShell infostealer). SentinelOne states its agent's on-device Static AI convicted every delivered payload before execution, even with the agent cut off from its cloud. The vendor also recorded 49 token requests to a poisoned Microsoft login domain, but cannot confirm their outcome.
Technical Details
- Delivery: the spoofer raced the legitimate resolver and rewrote only the terminal A record, replaying the genuine CNAME chain. Success rates ranged from 5.6% to 84% depending on the network.
- Lure: Windows' plain-HTTP connectivity check returned a forged reply, so the OS opened the default browser (Edge) at the adversary's page. The page served a browser updater matched to the victim's browser. SentinelOne saw manual download and launch, with no ClickFix-style lure on its endpoints. Manual launching is an inference, since Deep Visibility does not record mouse clicks.
- CornFlake capabilities: raw-input keylogger, clipboard monitoring, screenshots, microphone and webcam capture, USB monitoring. Persistence via services, Run keys and scheduled tasks, with a watchdog.
- ChocoShell capabilities: runs only in memory. It extracts live cookies from browser process memory and defeats Chrome App-Bound Encryption. It lifts Microsoft 365 and Entra ID tokens from the Token Broker cache. It disables AMSI via .NET reflection and runs a timing-based sandbox/VM check. It chains three UAC bypasses (SilentCleanup task, wsreset.exe, sdclt.exe).
- Token requests: 49 POSTs to the OAuth token endpoint were issued while the Microsoft login domain resolved to the adversary's address. On one endpoint they began about 24 hours before any payload. Roughly half of affected endpoints saw poisoning with no payload, suggesting the malware was not the sole objective.
- Detection outcome: Static AI convicted a partial .crdownload file and blocked launch in under 100 ms. SentinelOne reports 100% of delivered payloads were convicted in 100% of affected environments, with no execution from Downloads, no persistence, no post-incident C2 and no residual payload hashes.
- Hunt logic: group DNS answers by public IP, reduce queried names to eTLD+1, map to owning organisation and flag IPs answering for many unrelated owners. The adversary's address answered for about 135 domains across unrelated vendors including Adobe, Apple, Akamai, AnyDesk, BeyondTrust, Brother and Microsoft. This hunt surfaced nearly a third of confirmed endpoints that no alert had flagged. Weaker supporting signals:
- LLMNR responses carrying non-RFC1918 addresses.
- wpad. resolving to a non-RFC1918 address.
- The connectivity-check URL in a browser command line followed within 60 seconds by an executable or .crdownload in Downloads.
- Failed _ldap._tcp SRV lookups for your own domain controllers.
Remediation
- Disable LLMNR across managed estates, which removes the protocol the adversary answers on.
- Run the cross-vendor domain-per-IP hunt as a scheduled threat hunt, excluding CDNs by counting distinct domain owners rather than raw answers.
- For roaming staff with a suspected exposure window, review identity logs for sign-ins from unfamiliar infrastructure, anomalous token issuance and unexpected device registrations.
- Verify that endpoint protection can render a verdict locally when the network is hostile and the management console is unreachable.