Critical

How SentinelOne Blocked APT29's CaptiveCrunch Campaign

Cybersecurity Blog | SentinelOne

October 16, 2026 at 6:01 PM

Actively Exploited

Overview

SentinelOne successfully blocked a campaign known as CaptiveCrunch, which was associated with the Russian hacking group APT29. The attack aimed to perform local DNS poisoning and lure victims through captive portal networks, potentially compromising user data and network integrity. By utilizing its Static AI technology, SentinelOne managed to prevent these malicious activities on affected endpoints. This incident is significant as it showcases the ongoing threats posed by state-sponsored groups and emphasizes the need for robust endpoint protection measures to safeguard sensitive information. Organizations should be vigilant and ensure their defenses are updated to counter similar tactics.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Endpoints protected by SentinelOne's Static AI technology.
Action Required: Organizations should ensure their endpoint protection systems are updated and configured to block local DNS poisoning and similar network lures.
Timeline: Newly disclosed

Original Article Summary

Learn how SentinelOne's Static AI blocked APT29's CaptiveCrunch campaign on the endpoint, stopping local DNS poisoning and captive portal network lures.

Impact

Endpoints protected by SentinelOne's Static AI technology.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should ensure their endpoint protection systems are updated and configured to block local DNS poisoning and similar network lures.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, SentinelOne.

Read Original Article

Related Coverage

Hackers exploit SiteGuard WAF flaw to run commands as admins

BleepingComputer

Attackers are exploiting a serious OS command injection vulnerability in SiteGuard Server Edition, which allows them to execute commands with root or SYSTEM privileges on compromised servers. This flaw poses a significant risk to any organizations using this software, as it can lead to unauthorized access and control of sensitive systems. The vulnerability is currently being targeted in active attacks, raising concerns for companies that rely on SiteGuard for their web application firewall needs. It’s crucial for affected users to take immediate action to secure their systems and prevent potential breaches. The ongoing exploitation of this flaw highlights the importance of regular software updates and security assessments to protect against emerging threats.

Oct 18, 2026

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 119

Security Affairs

The latest Malware Newsletter from Security Affairs reveals several significant cybersecurity threats. One of the highlighted threats is the IronChain ransomware, which poses a risk to businesses by potentially causing permanent data loss and extensive downtime if a ransom is not paid. Additionally, researchers are concerned about AI models that could self-replicate without needing a datacenter, raising alarms about automated attacks. Another noteworthy development is the evolution of the XWorm malware, which has transitioned from being an infostealer to a surveillance platform, indicating a shift in the type of data attackers are targeting. Lastly, the Hirudo malware is noted for distributing fake updates, which could trick users into installing harmful software. These threats underscore the ongoing challenges businesses face in safeguarding their data and systems.

Oct 18, 2026

Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

A recent report indicates that North Korean IT workers have been using stolen U.S. identities to generate approximately $3 million. This situation raises serious concerns about identity theft and the extent of cyber operations conducted by North Korean entities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has noted this incident as part of a broader trend involving state-sponsored cybercriminal activities. Such actions not only threaten individuals whose identities were stolen but also pose risks to national security and international relations. As these cyber operations continue to evolve, they demonstrate the need for stronger identity verification measures and international cooperation to combat cybercrime.

Oct 18, 2026

Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed

Help Net Security

Last week, it was reported that a hidden implant was discovered in Ledger cryptocurrency wallets, which has been linked to a significant theft of around $93 million. This implant, likely used by cybercriminals, poses a serious risk to users' funds and security. Additionally, over 1,500 npm packages were found to be exposed, raising concerns about the safety of software dependencies in development environments. The incidents underscore vulnerabilities in widely used technologies, prompting users and developers to take immediate precautions to safeguard their assets and systems. As these incidents unfold, the importance of vigilance in cybersecurity practices becomes even clearer.

Oct 18, 2026

North Korean IT Workers Used Stolen US Identities to Earn $3 Million

Security Affairs

The FBI recently conducted raids on 40 homes in Texas as part of an investigation into a North Korean scheme that involved using stolen identities to create fake IT workers. These impostors targeted around 70 U.S. companies, helping the North Korean regime generate approximately $3 million. The Justice Department disclosed that two U.S. nationals were arrested in connection with this operation, which is part of a broader effort to disrupt North Korea's longstanding tactics of infiltrating American businesses. This incident raises significant concerns about identity theft and the potential for foreign interference in the U.S. economy, highlighting the vulnerabilities that companies face from sophisticated cyber schemes.

Oct 17, 2026

Drupal patches critical RCE flaws, warns exploits may emerge soon

BleepingComputer

Drupal has released patches for two serious vulnerabilities that could enable attackers to execute code remotely on any website running a supported version of its content management system. These vulnerabilities pose a significant risk, as they could allow unauthorized access and control over the affected sites. Users of Drupal are strongly advised to apply the patches immediately to protect their websites from potential exploitation. The urgency is underscored by the possibility that attackers may quickly develop exploits to take advantage of these vulnerabilities. Website administrators should prioritize this update to safeguard their systems and data.

Oct 17, 2026