How SentinelOne Blocked APT29's CaptiveCrunch Campaign

This report describes CaptiveCrunch, an APT29 campaign that leverages compromised captive portals and on-link LLMNR/NBT-NS poisoning to serve fake browser updaters that deliver the CornFlake RAT and the in-memory ChocoShell infostealer; SentinelOne telemetry observed poisoned DNS races, token POSTs to adversary infrastructure, and consistent endpoint prevention by local Static AI, and recommends disabling LLMNR and hunting for single addresses answering for many unrelated registrable domains.