Midnight Blizzard-Linked Operators Used Claude to Rebuild Detected Malware

An espionage cluster that researchers link to the Russian state actor Midnight Blizzard used Anthropic's Claude to rework its malware each time security tools caught it, keeping operations alive against government, diplomatic, think-tank and defence targets in Ukraine and Europe. Fresh research shows the tactic changed the files, but not what the malware did or where it phoned home, and that is how defenders mapped the campaign.

What happened

Anthropic tracks the activity as GTG-20006. It says the targeting and techniques match public reporting on Midnight Blizzard, and that the operation went after more than 20 organisations. The operator used Claude to find detected implants, modify them and redeploy them. AI was also used to build phishing infrastructure, push malware updates and handle stolen data.

ReversingLabs started from two published samples and expanded them into a wider campaign map (report dated 15 October):

• ChocoShell, a PowerShell stager that hides its window, relaxes the execution policy, runs Base64-encoded code and borrows public PowerSploit/Empire modules to collect browser history, query shadow copies over WMI and report progress through an HTTPS tracking-pixel endpoint.
• CornFlake, a Go-based Windows backdoor that persists through a Run-key entry and a scheduled task, injects into a suspended process and reads browser profiles and Microsoft Teams cache data. Sandbox runs also suggested keylogging.

Microsoft had earlier tied both families to its CaptiveCrunch reporting and to Storm-2945, which it assesses as an operational sub-group of Midnight Blizzard. According to that reporting, earlier stages of the chain abused compromised hotel and venue Wi-Fi portals to push travellers to phishing pages and ClickFix-style lures.

The researchers found five more stager builds across a 25-day window (9 July to 3 August), consistent with a continuous rebuild cycle, plus two 60-byte Internet Shortcut (.url) lures pointing to the same staging server. The shortcuts contained no executable code and 0 of 37 antivirus engines flagged them; the danger was entirely in where they led. The staging server was still serving malicious files on 5 October.

The caveats matter

This story is a good example of reading threat intel carefully:

• Attribution is not proven by the files. ReversingLabs says its own analysis does not independently establish who is behind the activity; the Midnight Blizzard link rests on Anthropic's and Microsoft's assessments.
• AI authorship of each variant is unconfirmed. The rebuild pattern fits Anthropic's account, but the researchers cannot tell from their data whether AI produced those particular versions.
• "First seen" is not "first detected." Early sightings of the samples show possession, not an independent malicious verdict; the files were classified as malicious only after Microsoft's disclosure.
• Not every match is the same actor. Some scripts shared the toolset but had no observed network link to the campaign, which leaves room for another operator reusing similar code.

Why it matters

AI-assisted rework makes hash-based detection cheap to beat: every rebuild gets a new hash, and some edits even broke fuzzy-hash similarity matching. What did not change was behaviour. All five rebuilt stagers shared the same 35-item capability profile, and the operator kept reusing the same beacon labels. A YARA rule built around those labels and PowerShell actions surfaced seven malicious scripts, including the original.

The message for defenders is simple: track what the malware does and where it connects. A file hash, or a low detection count on a reputation service, tells you little during an active investigation.

What to do

1. Hunt on behaviour, not hashes. Write detections for the behaviours above: hidden-window PowerShell with execution-policy changes and Base64 payloads, WMI shadow-copy queries from scripts, and HTTPS beacons to /t/pixel.gif-style endpoints carrying labels such as stage2_entry / stage2_ctx_.
2. Check endpoints for the persistence artefacts reported for CornFlake: %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe, a service named svchost32 / display name Cloud Sync Service, plus Run-key and scheduled-task entries pointing there. Note that svchost32.exe also shows up in unrelated malware, so confirm before you treat a hit as this campaign.
3. Treat .url / .lnk files as delivery vehicles. Block or quarantine Internet Shortcut attachments at the mail gateway, and alert when shortcuts launch PowerShell or fetch "JavaScript" that turns out to be script.
4. Lock down device-code sign-in. Restrict Microsoft Entra device-code authentication where it isn't needed, and review recent device-code sign-ins for anomalies.
5. Search your history, then block. Look back through proxy, DNS and EDR logs for the published infrastructure before you add it to blocklists, so you can find past contact as well as stop new contact. Key indicators (defanged): staging/C2 213[.]145[.]86[.]112, C2 104[.]194[.]151[.]133, data-holding server 104[.]194[.]159[.]55, and lookalike domains ms365-live[.]com, owa-ms365[.]com, ms365-device[.]com, m365-owa[.]com, wa-meeting[.]com, chamber-ua[.]org, cdncounter[.]net. Validate lower-confidence indicators before blocking.
6. Warn travelling staff. Executives and diplomats on hotel or venue Wi-Fi should use a VPN and never "fix" connectivity by running commands or opening files a captive portal offers.
7. Test detection rules against clean files before you deploy them. Some published indicators, such as the CornFlake import hash, also match plenty of benign Go binaries.

Based on reporting by Cyber Security News and on research published by ReversingLabs, Anthropic and Microsoft. Full file-hash and URL indicator lists are in the ReversingLabs report.