CaptiveCrunch — Midnight Blizzard (Storm-2945) traveler-targeting infrastructure

Created 2026-08-02 from the Microsoft blog IoCs plus a community DNS pivot (statistic-g.com resolves to ChocoShell C2 107.189.26.194). All campaign domains share the nameservers ns1-4.1domainregistry.com, but those nameservers are multi-tenant (thousands of unrelated domains, including typosquats), so they are deliberately NOT anchored, to avoid misattribution. The delivery vector is captive-portal traffic manipulation, so sightings are expected only if the infrastructure itself is scanned. Added 2026-08-02 from certificate-transparency and DNS pivots: o365bd3417a777636.com (certificate issued 2026-07-09; resolves to the blog-listed DNS-resolver IP 38.146.28.132; mail. and www. subdomains; in no public feed) and 104.145.210.184 (AS398256 UltaHost; co-resolved with ms365-live.com since 2026-07-17 and its only A record as of 2026-08-02, after the actor moved off the blog-listed IP). Certificate issuance dates corroborate the blog's first-seen dates (06-03, 07-09, 07-17, 07-20, 07-23, 07-27). Domain terms use a leading wildcard, so they cover each domain, its subdomains, and any longer name ending in the same string. The CornFlake (918fa52a…) and ChocoShell (be998574…) payload SHA-256s are not part of this query; both are listed in MalwareBazaar. Not anchored: the actor's /24 ranges, and the title "Acuity Systems" (a FruitStone alias, but plausibly a real company). ms365-device.com and m365-owa.com stopped resolving on 2026-08-02 and are kept for historical tracking. Added 2026-08-04: 192.142.52.31, the FruitStone C2 operator panel ("CloudSync Console"; AS214036, ZA/AFRINIC; linked to a CornFlake sample on VirusTotal), from a Hunt.io OSINT pivot not in the Microsoft blog.