Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Threat actor
Storm-2945
- Mentions · 7d0
- Mentions · 30d4
- All mentions9
- First seenAug 11, 2026
- Last mentioned14d ago
Timeline
9 articles · newest firstMidnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Midnight Blizzard’s CaptiveCrunch campaign abuses hotel Wi-Fi portals to deliver malware and steal cloud credentials.
80
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Midnight Blizzard's Storm-2945 resumed hotel captive-portal attacks that deliver CornFlake and steal traveler credentials.
78
From guidance to action: Security fundamentals that materially reduce risk
Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.
34
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
84
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
72
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
82
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
72
Appears with
- Midnight Blizzardthreat actor · 8
- Microsoftvendor · 8
- Microsoft 365product · 5
- Microsoftorganization · 5
- CornFlakemalware · 4
- ChocoShellmalware · 4
- APT29threat actor · 4
- Microsoft Teamsproduct · 3
- Claudeai model · 3
- Anthropicorganization · 3
- Anthropicvendor · 2
- UNC7005threat actor · 2
- WhatsAppproduct · 2
- Google Threat Intelligence Grouporganization · 2
- UNC6293threat actor · 2
- ReversingLabsorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.