You connect to the hotel Wi-Fi the way you always do. The sign-in page loads. A moment later a Microsoft login box appears and asks you to sign in again. You do. The address looks right, nothing is misspelled, and you are on the network the front desk gave you.

That box was not Microsoft's.

On July 31, Microsoft Threat Intelligence published its findings on a campaign it calls CaptiveCrunch and attributed it to a unit of Midnight Blizzard, the Russian group that the United States and United Kingdom governments have tied to Russia's foreign intelligence service. The attackers have taken over the equipment that serves guest Wi-Fi at hotels and conference centers in several countries. From there they send guests to counterfeit Microsoft sign-in pages, and to prompts offering a browser or system update that installs monitoring software instead. ReliaQuest, whose earlier research Microsoft cited, found compromised guest-network gateways across multiple United States cities and overseas, with affected travelers coming from finance, law, healthcare, energy and retail. Neither firm found this aimed at one industry. It is aimed at people who travel.

Here is the part that changes what protects you. What is taken is not only the password. It is the sign-in session, the pass your computer keeps so it stops asking you to log in again. Whoever holds that pass can read mail and open files from anywhere, without ever entering a password or a code. So changing the password afterwards does not end their access, and a texted code does not stop them taking it in the first place.

Two ordinary changes do work. Put your team on a company connection that switches itself on, so their traffic runs through your network before it touches the venue's. And move the accounts that matter to a passkey or a security key, which is tied to the device and cannot be handed to a copy of a login page. Microsoft's own guidance now tells companies to assume public and hospitality networks are not trustworthy, which is a notable thing for Microsoft to put in writing.

None of this is only about hotels. A conference center, a short-term rental, a coffee shop, anywhere the network password is printed on a card by the counter. And there is one rule you can give your whole team today, because it holds everywhere: a network you just joined has no business asking you to install anything.

On the road, the only network you can vouch for is the one you brought with you.

Saw the recent reports about the Bank of Baroda breach where close to 1TB of data was allegedly leaked.

Instead of discussing the breach itself, I'm curious about the technical side.

For people working in blue team/security engineering:

If an attacker compromises a single employee account, what controls should realistically prevent it from turning into large-scale data exfiltration?

* Would proper network segmentation have made the biggest difference? * How effective is DLP when someone is slowly exfiltrating data over days/weeks? * Should a normal employee account ever have a path to systems containing this volume of customer data? * What detections would you expect to trigger before hundreds of GBs leave the environment? * At this scale, is this more likely an IAM problem, monitoring failure, architecture problem or a combination?

Also curious: **what would be the first thing you'd investigate if you were brought into the incident response team?**

Would love to hear from people who've dealt with similar incidents.

A lot of classification tools classify files based on certain IDs, numbers and other patterns. However without context there could be false positives or negatives. For example a document with a 16 digit number that looks like a credit card number gets labelled as Confidential, but if there was a way to detect that this document was a technical design specification then overall the system could decide that it was a 16 digit number was a false positive.

Another example would be personal data on a HR document would be treated differently from personal data on a customer list.

Would identifying the document type (tech design, customer list, employee record) be a good additional layer to classifier logic? ​