“The compromised devices we investigated were appliances primarily used at hotels and other organizations running captive Wi-Fi services,” ReliaQuest researchers warned.
How the attackers are getting in and what they change
ReliaQuest’s July 23 write-up describes a multi-stage intrusion that begins with gaining administrative access to the routers and Wi‑Fi gateway appliances that run public and captive networks at hotels, conference centers and similar venues. Initial access, the researchers wrote, appears to come from exploiting exposed management interfaces — including SSH, SNMP and web administration consoles — and from weak or reused administrator credentials.
Once inside, the attacker modifies router configuration to perform DNS poisoning. That manipulation redirects DNS requests for legitimate domains through attacker-controlled infrastructure, allowing the adversary to observe and harvest login flows. ReliaQuest emphasizes that “a user can be compromised without the need for a phishing link, a malicious attachment or the attacker touching the device in any way,” because the traffic redirection happens at the network gateway level.
Where the compromises were observed
The researchers identified compromised Wi‑Fi gateways “around the world,” explicitly noting infections in multiple U.S. cities and in India and Saudi Arabia. The affected devices were appliances primarily used to deliver captive Wi‑Fi services; ReliaQuest also cautioned that other operators of captive portals share a similar attack surface, naming airports, conference centers, co‑working spaces, universities, healthcare facilities and event venues as structurally comparable targets.
Tradecraft and the attribution ReliaQuest noted
ReliaQuest described the DNS poisoning campaign as continuing and warned that the tradecraft bears similarity to earlier operations attributed to APT28 — also referred to by the names Fancy Bear and Forest Blizzard — a group that the researchers say has links to the Russian military intelligence agency (GRU). The report does not claim proof of attribution beyond that similarity; it presents the resemblance in techniques as a notable data point in assessing the campaign.
ReliaQuest’s technical mitigations and detection steps
To prevent poisoned DNS from reaching endpoints and to detect credential harvesting if it occurs, ReliaQuest published several concrete controls. Their recommendations include:
- Enforcing always-on VPN with full-tunnel configuration: require all corporate devices to use a VPN that routes all DNS requests through trusted corporate resolvers.
- Auditing proxy authentication logs for authentications from unknown hosts: look for suspicious logins originating from known abused infrastructure.
- Disabling web proxy auto-discovery (WPAD) where not required.
- Validating the site before entering credentials: train employees to verify the URL and certificate of any page requesting credentials, particularly on hotel, conference center, airport or other public Wi‑Fi networks.
- Disabling the device code authentication flow at the identity provider: in Microsoft Entra ID, configure a Conditional Access policy that blocks the device-code flow.
What this means for corporate travelers, venue operators, and security teams
Corporate travelers: Individuals using hotel or conference Wi‑Fi should assume the network could be manipulated and follow the advice ReliaQuest sets out — use an always‑on full‑tunnel VPN where your organization mandates it, and check URLs and certificates before entering credentials.
Venue operators (hotels, conference centers, airports): Operators of captive portals are singled out by name as sharing a “structurally similar attack surface.” They will need to harden management interfaces, remove or restrict exposed SSH, SNMP and web admin consoles, and audit for weak or reused admin credentials to reduce initial access risk.
Security teams and identity administrators: ReliaQuest’s detections and configuration changes give immediate, actionable steps — audit proxy auth logs, disable WPAD where unnecessary, and consider Conditional Access policies such as blocking device-code flows in Microsoft Entra ID to reduce credential-exfiltration vectors.
ReliaQuest’s advisory frames a particular danger: by compromising shared network gateways, an attacker can capture corporate credentials at scale without luring victims to a malicious link. The controls it prescribes are technical and administrative but specific — and they aim at both removing the attackers’ foothold and reducing the value of any intercepted traffic.
