Microsoft Links Hotel Wi-Fi Attacks to APT29

Microsoft has identified a global cyberattack campaign targeting hotel Wi-Fi networks that is associated with the Russian threat actor Midnight Blizzard, also known as APT29. These attacks aim to compromise Microsoft 365 accounts and steal sensitive data. Microsoft's security researchers have found that the attackers are using custom malware to infiltrate the networks. The attacks exploit vulnerabilities in hotel Wi-Fi networks to gain unauthorized access to guests' devices. The malware is designed to stealthily infiltrate systems and capture users' login credentials.

Microsoft has warned the affected hotels and their guests to review their security measures and change their passwords. A key aspect of these attacks is the use of phishing techniques to trick users into revealing their login credentials. The attackers send fake login pages that resemble the genuine Microsoft 365 pages to deceive users. This method has proven particularly effective, as many hotel guests often rely on public Wi-Fi networks and are less cautious with their login information. Microsoft has already taken steps to protect the affected users.

These steps include providing security updates and enhancing the detection of suspicious activities in Microsoft 365. Security researchers recommend that companies in the hospitality industry strengthen their network security and conduct training for employees on recognizing phishing attacks. The threat posed by APT29 is not new. This group is known for its sophisticated attacks and has targeted numerous organizations worldwide in the past. However, the connection to hotel Wi-Fi networks represents a new dimension, as these are often perceived as less secure and attract a large number of users.

The security situation is exacerbated by the fact that many hotels lack the necessary resources to adequately protect their networks. Often, IT departments are small and do not have the capacity to respond to the constantly evolving threats. Microsoft has pointed out that increased collaboration between the hospitality industry and IT security providers is essential to address these challenges. Attacks on hotel Wi-Fi networks are part of a larger trend where cybercriminals increasingly target public networks. According to a study by Cybersecurity Ventures, the costs of cybercrime are expected to rise to $10.5 trillion annually by 2025.

This figure underscores the urgency with which companies must improve their security measures. Microsoft has classified the vulnerability exploited in these attacks as critical. Researchers have already identified several specific variants of malware used in these attacks. The malware is designed to self-update and adapt to evade detection by security software. Security authorities worldwide have urged the hospitality industry to review their security protocols and ensure that all systems are up to date. The use of strong passwords and the activation of two-factor authentication are recommended as fundamental measures to enhance user security. Microsoft plans to inform affected users about the latest security updates and provide guidance on improving their network security by the end of August 2026.