What happened
ReliaQuest identified compromised captive-portal gateways at hotels and conference venues across several US cities and in India and Saudi Arabia. Activity had been observed since at least June and affected traffic from organisations in financial services, professional services, legal, healthcare, energy and retail.
Attackers altered gateway DNS behaviour so connected devices could be redirected to Microsoft-impersonating infrastructure. ReliaQuest identified four related domains and two hosting addresses. In roughly one-third of investigated cases, the actor also attempted Web Proxy Auto-Discovery abuse, although the researchers could not confirm those attempts succeeded.
In a limited number of cases, the campaign used Microsoft’s device-code authentication flow. A user approving the presented request caused Microsoft to issue a valid, MFA-satisfied OAuth token to the attacker’s client. ReliaQuest observed continued operator infrastructure activity on 23 July. It assessed overlap with previous APT28 tradecraft but did not attribute the current campaign directly because infrastructure and other technical linkage were absent.
Why this matters now
The technique moves the trust boundary beneath the endpoint. A patched laptop with endpoint detection and MFA can still be exposed when the network supplying its DNS responses is hostile. Hard-coded public DNS does not solve the problem if the gateway can intercept unencrypted requests.
The device-code path is particularly important because a password reset may not address an attacker-held token or enrolled device. Organisations need identity investigation procedures that terminate sessions, remove unauthorised devices and review application consent, not a standard credential-phishing response alone.
The decision for security leaders
Set a mandatory travel endpoint standard in which the VPN starts automatically, uses full tunnelling and prevents traffic before establishment. Audit split-tunnel exclusions to ensure DNS and authentication endpoints cannot escape the tunnel. Use strict encrypted DNS only where it can be enforced without plaintext fallback.
Apply Conditional Access controls that block device-code authentication by default. Where legacy or specialised workflows require it, constrain the exception by user, device, application and duration, and monitor every use. Identity teams should correlate the published indicators with travel dates and investigate successful authorisations from affected users.
Evidence of closure
- Endpoint policy showing that internet access is blocked until the corporate full-tunnel VPN is established.
- Conditional Access evidence blocking device-code authentication for users without approved exceptions.
- A reviewed exception register linking every permitted authentication flow to an owner and expiry date.
- Hunt results covering reported domains, IP addresses, OAuth clients, device registrations and relevant traveller populations.
The Security.io assessment
The observed infrastructure and authentication behaviour provide credible evidence of an active campaign. The claimed resemblance to APT28 is an analytical judgement based on tradecraft and should not drive the defensive priority or executive narrative.
The more durable conclusion is architectural: MFA does not compensate for an authentication flow that asks the user to approve an attacker-originated session. Enterprises should treat device-code use and pre-VPN network access as controllable exceptions, not defaults.
Questions for the morning meeting
- Are travel laptops technically prevented from reaching the internet before the trusted tunnel starts?
- Which business processes genuinely require device-code authentication?
- Can the identity team link high-risk sign-ins to corporate travel records quickly enough for incident response?