Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Organization
ReversingLabs
- Mentions · 7d0
- Mentions · 30d4
- All mentions9
- First seenSep 22, 2026
- Last mentioned25d ago
Timeline
9 articles · newest firstMalware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Top 10 Best Malware Analysis Tools in 2026 [Ranked & Scored]
A 2026 roundup ranks malware sandboxes and file-intelligence tools, led by context, interactive, and evasion-resistant analysis.
18
Your AI agent is only as safe as the packages it downloads
Op-ed says AI agent escapes and malicious packages all moved through the software supply chain.
72
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
58
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
76
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Malicious npm package tw-pkgprobe-7731 posed as a Twilio bug-bounty probe and can steal credentials.
58
Appears with
- Claudeai model · 5
- Anthropicvendor · 4
- ReversingLabsvendor · 4
- Anthropicorganization · 4
- Microsoftvendor · 4
- ChocoShellmalware · 3
- npmproduct · 3
- CornFlakemalware · 3
- Midnight Blizzardthreat actor · 3
- Microsoftorganization · 3
- GTG-20006threat actor · 3
- Geminiai model · 2
- GitHubvendor · 2
- Storm-2945threat actor · 2
- Nxproduct · 2
- Shai-Huludmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.