How SentinelOne Blocked APT29's CaptiveCrunch Campaign
One-Click Integrations for Unified Prevention, Detection, and Response Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne ® has long argued.
One-Click Integrations for Unified Prevention, Detection, and Response Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne ® has long argued.
Wherever the laptop sits, name resolution tells it the truth and the agent can reach its own cloud, and in July 2026, Microsoft disclosed a campaign that breaks both and named it CaptiveCrunch.
We also found the adversary answering from inside the victims' own networks, which no public account of the campaign describes; because the Storylines are scattered across the campaign, he worked in two views.
We can confirm token requests were issued while the poisoning was active, to a login domain resolving to the adversary.
Outside the industry it is best known for the SolarWinds compromise, and public accounts of CaptiveCrunch describe compromised captive-portal infrastructure, but our telemetry shows something narrower.
The DnsPoison indicator recorded LLMNR responses on UDP/5355 carrying the adversary's address on roughly a third of affected hosts, and anything answering those queries had to be sitting on the victim's own broadcast domain.
What happened
One-Click Integrations for Unified Prevention, Detection, and Response Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne ® has long argued.
Wherever the laptop sits, name resolution tells it the truth and the agent can reach its own cloud, and in July 2026, Microsoft disclosed a campaign that breaks both and named it CaptiveCrunch.
What changed
We also found the adversary answering from inside the victims' own networks, which no public account of the campaign describes; because the Storylines are scattered across the campaign, he worked in two views.
We can confirm token requests were issued while the poisoning was active, to a login domain resolving to the adversary.
Who is affected
Outside the industry it is best known for the SolarWinds compromise, and public accounts of CaptiveCrunch describe compromised captive-portal infrastructure, but our telemetry shows something narrower.
Why it matters
The DnsPoison indicator recorded LLMNR responses on UDP/5355 carrying the adversary's address on roughly a third of affected hosts, and anything answering those queries had to be sitting on the victim's own broadcast domain.
Attribution
SentinelOne: One-Click Integrations for Unified Prevention, Detection, and Response Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne ® has long argued.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.