Do Son 
DNS poisoning attack flow | Image: ReliaQuest
At a glance
| Actor | Unnamed operator; ReliaQuest notes tradecraft similar to APT28 (Fancy Bear, Forest Blizzard) but does not attribute the campaign |
| Activity type | Gateway compromise, DNS poisoning, adversary-in-the-middle credential harvesting, device-code flow abuse |
| Targets | Traveling corporate employees on hotel and conference center Wi-Fi |
| Scale | Compromised gateways across multiple US cities plus India and Saudi Arabia; no victim count or loss figure published |
| Status | No arrests, charges, or takedown announced for this campaign |
| Source | ReliaQuest Threat Research |
TL;DR
ReliaQuest published research on 23 July 2026 describing attackers who compromise hotel and conference center Wi-Fi gateways. Once inside, they poison DNS for every guest and redirect traffic toward fake Microsoft pages. The activity has run since at least June 2026, and full-tunnel VPN shuts it down.
What happened
The attack starts at the gateway, not the laptop. Someone gains administrative access to an internet-facing captive portal appliance. That device hands out DNS to every guest who joins, so controlling it means controlling name resolution across the whole network.
ReliaQuest assesses with low-to-medium confidence that intruders got in through exposed management interfaces such as SSH, SNMP, and web consoles, paired with weak or reused admin credentials. Visibility limits stopped the team from confirming that hypothesis.
From there the operator forges DNS answers. Researchers put the appeal plainly: “no phishing link, no malicious attachment, no endpoint compromise required.” Four attacker-registered domains, including m365-owa[.]com and ms365-live[.]com, served Microsoft-impersonation lures. ReliaQuest ties all four to a single operator with high confidence.
Why hard-coded DNS does not stop hotel Wi-Fi DNS poisoning
Pointing a device at 8.8.8.8 does not help. The query still leaves the laptop unencrypted, so the gateway can read it and rewrite the answer. Two configurations do stop the redirect: full-tunnel VPN, or encrypted DNS in strict mode with plaintext fallback disabled. Opportunistic DoH leaves the gap wide open.
Two extras worth knowing
In roughly a third of observed cases, the operator also attempted WPAD abuse. Success would route most Windows application traffic through an attacker proxy. ReliaQuest could not confirm it worked and describes it as opportunistic.
Device-code flow abuse is the sharper risk. A user approves what looks like a routine Microsoft prompt, and Microsoft then issues valid OAuth tokens to the attacker’s client. That hands over MFA-satisfied access without anyone capturing a password.
Who is behind it
Nobody has been named, and no charges exist. ReliaQuest says the tradecraft resembles APT28, the Russian military intelligence group also tracked as Fancy Bear and Forest Blizzard. The firm stops short of attributing this campaign to APT28, and that distinction matters. Its assessment rests on overlapping techniques rather than shared infrastructure, code reuse, or an operator mistake.
The comparison points at FrostArmada. International authorities disrupted that APT28 router campaign on 7 April 2026, working alongside Microsoft and Lumen’s Black Lotus Labs. Researchers there called it “a nearly invisible attack that required no interaction from the end user”. At its December 2025 peak, FrostArmada reportedly reached 18,000 IP addresses across 120 countries.
This campaign diverges in three ways. It hits captive portals rather than home routers. Its domains and IP addresses do not match prior APT28 infrastructure. It also redirects every DNS query instead of filtering by keyword, which ReliaQuest reads as a possible sign of a less careful operator.
Impact and scale
ReliaQuest published no victim count and no financial figure. Compromised gateways appeared across multiple US cities and in India and Saudi Arabia, mostly at hospitality organizations. Traffic to those gateways came from financial services, legal, health care, energy, retail, and professional services firms.
Arithmetic explains why hotel Wi-Fi DNS poisoning deserves attention. One appliance covers every guest on that network for the day, and none of them need to click anything.
How to stay protected
- Enforce always-on VPN in full-tunnel mode, then audit split-tunnel exceptions
- Block the device-code flow with a Conditional Access policy in Microsoft Entra ID
- Disable WPAD through Group Policy wherever automatic proxy discovery is not required
- Use strict-mode encrypted DNS rather than the opportunistic default
- Review proxy authentication logs for sign-ins from unfamiliar hosts
- Train traveling staff to check the URL and certificate before typing credentials
ReliaQuest flags one domain as hosting an active operator panel, so the campaign may still be running. The complete indicator list and detection guidance sit in ReliaQuest’s threat spotlight on hotel Wi-Fi DNS poisoning.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
