How SentinelOne Blocked APT29's CaptiveCrunch Campaign
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The post shows APT29 using captive portal lures and local DNS poisoning for initial access, a concrete TTP pattern for endpoint detection.
Description
APT29, a Russian state actor, is linked to the CaptiveCrunch campaign involving captive portal network lures and local DNS poisoning. The attacks use fake Wi-Fi login pages to trick victims into entering credentials and manipulate local DNS resolution to reach malicious destinations. SentinelOne reports that its Static AI engine blocked the activity on the endpoint. It is a targeted campaign against Western organizations; exploitation of software vulnerabilities is not mentioned. The report provides TTPs for detection and defense.
Risk score
- strategic relevance
- 0.85
Path: strategic