{"id":1449,"date":"2026-08-22T17:31:17","date_gmt":"2026-08-22T22:31:17","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1449"},"modified":"2026-08-22T17:38:21","modified_gmt":"2026-08-22T22:38:21","slug":"hotel-wi-fi-attacks-target-las-vegas-business-travelers","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/hotel-wi-fi-attacks-target-las-vegas-business-travelers\/","title":{"rendered":"Hotel Wi-Fi Attacks Target Las Vegas Business Travelers"},"content":{"rendered":"
\n

\u26a0 Cybersecurity Alert<\/span><\/p>\n

Hotel Wi-Fi Security: Why Your Next Las Vegas Business Trip Is a Target<\/h2>\n

A Russian state-sponsored hacking group is hijacking hotel and convention Wi-Fi to steal Microsoft 365 logins \u2014 and Las Vegas books more conventions than any other city in America.<\/p>\n

Published by CMIT Solutions of Las Vegas \u00b7 Cybersecurity \u00b7 7 min read<\/p>\n<\/div>\n

What Is CaptiveCrunch, and Why Should Las Vegas Businesses Care?<\/h2>\n

On July 31, 2026, Microsoft Threat Intelligence disclosed an ongoing campaign it calls CaptiveCrunch<\/strong> \u2014 a hotel Wi-Fi security<\/strong> threat in which attackers took control of the captive-portal equipment that powers guest Wi-Fi at hotels and conference venues in multiple countries. Microsoft attributes the activity to Storm-2945, an operational sub-cluster of Midnight Blizzard<\/strong> \u2014 also tracked as APT29 or Cozy Bear \u2014 which the U.S. and U.K. governments have formally attributed to Russia’s Foreign Intelligence Service, the SVR.<\/p>\n

The campaign has been running since at least early May 2026, and it is not aimed at the hotels themselves. It is aimed at the Microsoft 365 accounts of the business travelers who connect to that Wi-Fi. That distinction matters enormously for a city like Las Vegas, which hosts more trade shows and conventions than anywhere else in the country. Every executive checking email from a Strip hotel room, every sales rep logging into a client portal from a convention center lobby, and every out-of-town vendor visiting a Las Vegas gaming or hospitality business is connecting through exactly the kind of network this group has learned to compromise.<\/p>\n

The Stat That Should Worry You<\/span>
\nMicrosoft found that Storm-2945 compromised shared captive-portal vendor infrastructure<\/strong> serving many hotels and venues at once \u2014 not individual properties. One vendor breach can silently expose guest Wi-Fi across dozens of hospitality locations simultaneously, including the convention hotels Las Vegas depends on to fill its calendar year-round.<\/div>\n

How the Attack Works<\/h2>\n

CaptiveCrunch is technically sophisticated, but the entry point is something every business traveler does without thinking \u2014 clicking “Connect” on a hotel Wi-Fi splash screen. Here is what happens on a compromised network:<\/p>\n