Automated evidence cluster

APT29: Healthcare targeting activity

Automatically correlated reporting linking APT29 to activity affecting Healthcare. Review the supporting sources before treating attribution as confirmed.

55% correlation confidence.This grouping supports investigation. It is not a definitive attribution or a vendor-assigned campaign name.

1Reports

1Sources

48Highest signal

31 Jul 2026Latest activity

Actors in supporting reports

APT29STORM-2945

Supporting evidence

Microsoft Security Blog · 31 Jul 2026

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft ↗

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an…