Beyond the Firewall: How Russia Targets Hotel WiFi and German Elections in New Hybrid Offensive
Russian intelligence has opened a new hybrid front against the West. According to Microsoft Threat Intelligence and German security agencies, Kremlin-backed actors are hijacking hotel WiFi networks to deploy malware on executives' devices while simultaneously running the "Matryoshka" disinformation campaign to influence Germany’s regional elections.
The two operations rely on different tactics, but they follow the same strategic logic: avoid the strongest defences and exploit the spaces where Western governments and businesses are hardest to protect.
Turning Hotel WiFi into an Intelligence Tool
The operation, known as "CaptiveCrunch", marks another step in the evolution of Midnight Blizzard, the Russian state-sponsored espionage group also tracked as Storm-2945 and linked to NOBELIUM and Cozy Bear.
Instead of attempting to breach heavily protected corporate systems, the group has shifted its attention to something far less secure: the public networks that business travellers use every day.
According to Microsoft, the attackers take control of legitimate captive portal login pages - the screens users encounter before connecting to hotel or conference WiFi. Once victims enter their details, Microsoft 365 credentials can be stolen before the attack moves to its next stage.
That second stage depends less on technical sophistication than on persuasion.
Victims are prompted to install what appears to be a routine Windows or browser update. In reality, the download delivers malicious software that quietly establishes long-term access to the device.
The campaign uses two principal tools. The CornFlake remote access trojan allows attackers to maintain persistent control, while the ChocoShell PowerShell infostealer is designed to harvest credentials, session cookies and files. It can also record keystrokes, activate microphones and cameras, and target Android devices.
For intelligence services, the immediate theft of passwords is only part of the reward.
Compromised Microsoft 365 accounts can provide a pathway into an organisation's wider cloud environment, giving attackers access that extends well beyond the laptop connected to the hotel network. An employee may leave the conference, return to work and continue using the same device, unaware that surveillance is still taking place.
That makes the hotel stay only the beginning of the operation rather than its end.
The New Perimeter Is Everywhere
For years, cybersecurity strategy focused on defending corporate infrastructure from external intrusion. As those defences became more resilient, attackers adapted.
CaptiveCrunch illustrates that shift. Instead of confronting hardened networks directly, Russian operators are targeting the people who move between them.
Business travel has become part of the enterprise security perimeter, even if companies have little control over the infrastructure their employees rely on while away from the office.
That changes the nature of cyber defence.
The traditional assumption - that a trusted user inside the network is inherently less risky than someone outside it - has become increasingly difficult to sustain. Organisations are instead being pushed towards continuous verification of users and devices, regardless of where they connect.
The campaign also highlights a simpler reality: people remain easier to manipulate than well-defended systems.
A convincing software update presented at the right moment can achieve what months of probing against a corporate firewall cannot.
Germany's Elections Become Part of the Same Battlefield
The cyber campaign is unfolding alongside another Russian operation that targets a different vulnerability: public trust.
German security agencies say they are monitoring an expanded disinformation campaign, known as "Matryoshka" or "Overload", ahead of September's state elections in Berlin, Saxony-Anhalt and Mecklenburg-Western Pomerania. While CaptiveCrunch seeks access to information, Matryoshka is designed to shape the political environment in which that information exists.
The campaign is centrally organised from Russia through specialised proxy companies. More than 180 fabricated posts and videos have already appeared on X, Bluesky and TikTok, according to German officials and European media.
The approach is familiar, but increasingly polished.
Instead of relying on anonymous propaganda accounts, the operation mimics trusted news organisations. Posts carry the branding of outlets such as the BBC, ARD, Deutsche Welle and the Frankfurter Allgemeine Zeitung, making false stories appear credible at first glance. Those stories accuse politicians from Germany's governing parties - the CDU, SPD, Greens and FDP - of offences ranging from financial misconduct to sexual harassment.
The objective is less about convincing voters that every allegation is true than about creating a steady stream of doubt around mainstream political figures.
That dynamic inevitably benefits the Alternative for Germany (AfD), whose leadership has repeatedly argued for restoring political ties with Moscow.
The timing is hardly accidental. September's regional elections could give the AfD its strongest showing yet, particularly in Saxony-Anhalt, where the party has a realistic chance of leading a state government.
For European officials, that raises concerns extending well beyond domestic German politics.
Earlier this year, European diplomats warned that AfD participation in state governments could create new opportunities for Russian intelligence. Germany's federal system gives regional administrations access to sensitive EU material through legislative and governmental structures, making state-level elections strategically more important than they might otherwise appear.
Two Campaigns, One Strategy
Viewed independently, a hacked hotel WiFi network and a fake political video have little in common.
Viewed together, they reveal a consistent pattern.
Rather than trying to overpower Western institutions directly, Russian intelligence is exploiting the systems that connect them. Travelling officials rely on networks they do not control. Democratic debate increasingly depends on commercial social media platforms that struggle to keep coordinated disinformation in check.
Those spaces have become attractive precisely because they sit outside the traditional security perimeter.
Breaking into a ministry's network is difficult. Compromising the laptop of a diplomat staying in a hotel may be considerably easier. Manipulating vote counting would likely trigger an immediate political crisis; flooding social media with fabricated scandals can gradually erode confidence without ever touching the electoral infrastructure itself.
That shift has blurred the old distinction between external and internal security.
Enterprise networks now extend into hotel lobbies and conference centres. Regional elections, once viewed largely as domestic affairs, have become another arena where geopolitical competition plays out.
Europe's Defences Are Having to Adapt
German Interior and Foreign Ministry officials say they are actively tracking the Matryoshka campaign as the regional elections approach. Their response is unfolding alongside a broader debate in Brussels over how Europe should deal with foreign interference that no longer fits neatly into either cybersecurity or election law.
The European Parliament has repeatedly called for tougher enforcement of the Digital Services Act, stronger monitoring of foreign information manipulation and interference (FIMI) through the European External Action Service, and wider sanctions against the tools used in hybrid operations. Those proposals are expected to feed into discussions around the EU's twentieth sanctions package.
The cyber dimension is changing just as quickly.
Protecting a company's headquarters is no longer enough if employees regularly work from airports, hotels and conference venues. Organisations are increasingly expected to build security around the user rather than the office, relying on phishing-resistant multi-factor authentication, encrypted VPN connections, dedicated travel routers and stricter controls over software updates outside managed environments.
Midnight Blizzard has been linked to some of the most significant Russian espionage operations of recent years, including the SolarWinds compromise. CaptiveCrunch points to a quieter evolution of that playbook. Instead of pursuing one spectacular breach, the group appears to favour countless routine interactions that attract little attention on their own but can provide lasting access to government and corporate systems.
The same principle underpins the Matryoshka campaign.
Neither operation depends on attacking the strongest part of the system. Both look for the gaps between institutions - the hotel network trusted by a travelling official, the social media feed trusted by a voter, the familiar news logo that makes a fabricated story look authentic.
That is becoming one of the defining features of modern hybrid conflict. The contest is no longer confined to government networks or military infrastructure. It increasingly plays out across the ordinary digital services that governments, businesses and citizens use every day, where the line between convenience and vulnerability is often difficult to see until it has already been crossed.