Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Threat actor
GTG-20006
- Mentions · 7d0
- Mentions · 30d4
- All mentions12
- First seenSep 10, 2026
- Last mentioned13d ago
Timeline
12 articles · newest firstMalware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain
Anthropic says criminals and state-linked actors used Claude agents to automate phishing, credential theft, and data theft.
82
Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data
Anthropic reports state-linked and criminal actors used Claude AI agents to automate espionage, extortion, and exploit development, stealing 300,000+ identity records and drone IP.
78
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.
78
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
82
How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data
Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.
80
Countering misuse of AI: September 2026 / Anthropic
Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.
70
Hackers Abuse Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft
Anthropic reports actors including GTG-20006 (Midnight Blizzard-linked) and ShinyHunters clusters abused Claude AI agents to automate phishing, credential harvesting, and data theft against 20+ organizations.
78
Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection
Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.
82
Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research
Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.
78
Appears with
- Anthropicorganization · 12
- Anthropicvendor · 11
- Midnight Blizzardthreat actor · 9
- Claudeproduct · 9
- Claudeai model · 9
- ShinyHuntersthreat actor · 7
- Microsoftvendor · 6
- Claude Opusai model · 4
- APT29threat actor · 4
- Microsoftorganization · 4
- GTG-50014threat actor · 3
- Claude Haikuai model · 3
- ReversingLabsorganization · 3
- Claude Sonnetai model · 3
- CornFlakemalware · 3
- ChocoShellmalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.