Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Threat actor
Midnight Blizzard
- Mentions · 7d0
- Mentions · 30d7
- All mentions21
- First seenAug 11, 2026
- Last mentioned13d ago
Timeline
21 articles · newest firstMalware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain
Anthropic says criminals and state-linked actors used Claude agents to automate phishing, credential theft, and data theft.
82
Ransomware gets personal: 'We-know-where-you-are kind of stuff'
Semperis survey finds 37% of ransomware cases include psychological or physical threats against staff and families.
66
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Midnight Blizzard’s CaptiveCrunch campaign abuses hotel Wi-Fi portals to deliver malware and steal cloud credentials.
80
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Midnight Blizzard's Storm-2945 resumed hotel captive-portal attacks that deliver CornFlake and steal traveler credentials.
78
TeamViewer urges users to patch severe flaws “as soon as possible”
TeamViewer urges immediate updates for five high-severity client and host flaws, including a remote code-execution bug.
72
From guidance to action: Security fundamentals that materially reduce risk
Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.
34
From Hacks to Bioweapons, Claude Misuse Is Now Everywhere
Anthropic reports Claude was misused by Midnight Blizzard, ShinyHunters, disinformation campaigns, and bioweapon attempts; roundup also covers Xinbi takedown.
72
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.
78
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.
78
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
82
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
84
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.
85
Hackers Abuse Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft
Anthropic reports actors including GTG-20006 (Midnight Blizzard-linked) and ShinyHunters clusters abused Claude AI agents to automate phishing, credential harvesting, and data theft against 20+ organizations.
78
Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection
Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.
82
Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research
Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.
78
AI lets small actors run state-level hacking campaigns, Anthropic report finds
Anthropic's threat report finds AI let a Russian-aligned espionage campaign, a Chinese student-run exploit foundry and ShinyHunters operators run state-grade operations.
80
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
82
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
72
Related CVEs
by mentions- Access Control Bypass in TeamViewer Full Client and Host Could Lead to RCE
- Heap buffer overflow in TeamViewer Linux and macOS clients
- Path traversal LPE in TeamViewer Full Client and Host
- TOCTOU privilege escalation in TeamViewer Windows installer
- Path validation race in TeamViewer Linux session recording
Appears with
- Microsoftvendor · 16
- Anthropicvendor · 13
- Anthropicorganization · 12
- Claudeai model · 12
- Claudeproduct · 10
- ShinyHuntersthreat actor · 10
- GTG-20006threat actor · 9
- Storm-2945threat actor · 8
- Microsoftorganization · 8
- APT29threat actor · 7
- Microsoft 365product · 6
- CornFlakemalware · 5
- ChocoShellmalware · 5
- Cozy Bearthreat actor · 3
- ReversingLabsorganization · 3
- Microsoft Teamsproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.