Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection

Hackers linked to Midnight Blizzard used Anthropic’s Claude AI to rebuild malware after security tools detected it, helping them keep espionage operations running against Ukrainian and European targets.

New research shows that changing a file’s code and hash did not erase the shared behavior and server links that helped investigators trace the campaign.

Anthropic tracks the activity as GTG-20006 and says its targeting and methods match public reporting on Midnight Blizzard. The operation targeted more than 20 government, diplomatic, think tank and defense organizations.

Its use of Claude AI attack automation extended beyond writing code to phishing systems, malware updates and stolen data collection.

Researchers from ReversingLabs identified and classified the malware, then expanded two published file hashes into a wider campaign map.

Their October 15 research report linked the samples to a staging server, five additional PowerShell builds, two shortcut lures and connections between phishing domains and servers. However, their file analysis does not independently prove the actor’s identity.

Midnight Blizzard-Linked Hackers Use Claude AI

Anthropic said the operator used Claude to find, change and redeploy detected implants. ReversingLabs found five additional stager builds across a 25-day window, from July 9 to August 3.

That pattern fits an ongoing rebuild cycle, but the researchers cannot determine from their own records whether AI produced those versions.

The two starting samples were ChocoShell, a PowerShell stager, and CornFlake, a Windows backdoor written in Go.

Microsoft named both in its CaptiveCrunch reporting and linked that operation to Storm-2945, which it assesses as an operational sub-group of Midnight Blizzard. ReversingLabs first saw CornFlake on July 6 and ChocoShell on July 10.

Those early sightings need careful reading. ReversingLabs classified both files as malicious on August 1, one day after Microsoft published its report. The classification relied on threat reputation.

Its records therefore show earlier possession of the samples, not an independent malicious verdict before Microsoft’s disclosure.

Inside the ChocoShell and CornFlake Toolset

ChocoShell hides its window, changes PowerShell’s execution policy and runs Base64-encoded code. It uses public PowerSploit and Empire code to collect browser history, checks Windows shadow copies through WMI and runs background jobs.

Its HTTPS messages report progress through a tracking-pixel endpoint, while Microsoft also described browser credential theft and data uploads.

Investigators found two 60-byte Windows Internet Shortcut files pointing at the staging server. One led to a short download path; the other pointed to a PowerShell payload disguised as a JavaScript bundle.

Neither shortcut contained executable code, and none of 37 antivirus engines flagged them. Their danger came from the destinations they opened. Microsoft’s account places compromised hotel and venue network portals earlier in the attack chain.

These hotel Wi-Fi malware attacks redirected travelers to phishing pages and ClickFix prompts. ReversingLabs did not observe that upstream activity, so its shortcut findings should not be treated as proof of every step Microsoft described.

CornFlake establishes continued access through a registry startup entry and another path involving Windows task scheduling. It injects into a suspended process and reads browser profiles and Microsoft Teams cache data.

Sandbox findings also showed signs of keylogging. Importantly, ReversingLabs did not observe how CornFlake reached victims or establish a direct delivery link from ChocoShell.

The strongest connection between the rebuilt stagers was behavior. All five shared the same 35-item capability profile despite different hashes. Some code changes broke fuzzy-hash matching, which compares file similarity.

Yet the same beacon labels remained. A YARA search built around those labels and PowerShell actions found seven malicious scripts, including the original sample.

Two additional stagers and both shortcuts had strong infrastructure links. Other scripts shared the toolset but lacked an observed network connection, leaving room for another operator using similar code. That distinction matters when deciding which findings support campaign attribution and which provide hunting leads.

The staging server still delivered malicious files during checks on October 5. ReversingLabs recommends searching historical records, blocking confirmed infrastructure and reviewing Microsoft Entra device-code sign-ins.

Earlier Teams chat credential theft shows the group’s wider focus on account access. Teams should restrict unused device-code authentication and test detection rules against clean files before deployment.

The practical lesson is to follow what malware does and where it connects, rather than depend only on a file hash or low detection counts from outside reputation services during an active investigation.

Indicators of compromise (IoCs):-

File Hashes

File or role	SHA-256	SHA-1
ChocoShell — original PowerShell sample	be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c	937e75e0e1c82eecab69e9b8ad481bd7e0845308
CornFlake — Go backdoor	918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593	510af9bb00ff5d4a6856b1291af55db9f6e13551
Additional stager 1 — infrastructure-linked	ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25	154d8cfd9e304b6644216456759b7fd12daf85c1
Additional stager 2 — shared toolset	20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38	7acb7082d37854877a08999374460c9d7e5cd663
Additional stager 3 — infrastructure-linked	1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916	1b97e0df9600335b0cd8db2eb4577d3dbf6e76db
Additional stager 4 — shared toolset	403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f	99f2eac2f00451a9a55521905add54205e336b9d
Additional stager 5 — shared toolset	6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97	04b64591837c5c2696c2a4423b1bb3dab00a0f01
Seventh YARA match — comparison pending	28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3	6e5c658261f72fda92d475ac96f0213159af785d
Delivery shortcut 1 — infrastructure-linked	5bc3c615da8dd7ef45e421d26a97644679ba0a0647b24efc96ebed8348f403d2	9c5c539138df6cfcd854c55316bb527520025928
Delivery shortcut 2 — infrastructure-linked	92cf0b883d220ba37f5ab378920fefdfdddc4fa76ee6c046696a7e5853a95c33	e82a7c86677c5752dceb6b848754698571fb0aa8

The source also provides the following MD5 and import-hash values. The import hash matches many unrelated clean and malicious Go files, so it is not a reliable standalone detection indicator.

Hash type	Value	Associated file or limitation
MD5	c6f4df18cb880500f3921a179c3a3766	ChocoShell
MD5	fba867df17721879df9d8dcca68d6900	CornFlake
Import hash	4e2bd2c481372f7ab13b83b63b424e97	CornFlake; common Go toolchain fingerprint

IP Addresses, Domains and Email Addresses

Type	Indicator	Reported role or context
IPv4	213[.]145[.]86[.]112	Stager hosting, beacon endpoint and ChocoShell C2
IPv4	104[.]145[.]210[.]184	Embassy Kit device-code phishing server
IPv4	31[.]57[.]243[.]154	Phishing host associated with the Outlook lookalike
IPv4	104[.]194[.]151[.]133	Primary command-and-control server
IPv4	104[.]194[.]159[.]55	Server holding stolen browser-data archives
IPv4	38[.]146[.]28[.]75	Phishing-console notifier and Microsoft-listed AitM infrastructure
IPv4	107[.]189[.]26[.]194	Microsoft-listed second ChocoShell C2 and DNS resolver
IPv4	104[.]194[.]159[.]150	Microsoft-listed CaptiveCrunch AitM infrastructure
IPv4	38[.]146[.]28[.]132	CaptiveCrunch DNS resolver
IPv4	192[.]142[.]52[.]31	Moderate-confidence backdoor hunting lead; validate before blocking
IPv4	172[.]67[.]136[.]242	Cloudflare serving address observed for the Microsoft 365 lookalike
IPv4	188[.]114[.]97[.]3	Cloudflare serving address observed for the WhatsApp lure
IPv4	45[.]59[.]122[.]181	Serving address observed for the Ukrainian chamber lookalike
IPv4	107[.]189[.]24[.]79	Serving address observed for the Chatham House lookalike
Domain	ms365-live[.]com	Microsoft 365 device-code phishing lookalike
Domain	owa-ms365[.]com	Outlook Web Access lookalike
Domain	ms365-device[.]com	Microsoft 365 lookalike
Domain	m365-owa[.]com	Microsoft 365 lookalike
Domain	wa-meeting[.]com	WhatsApp Web pairing-code phishing lure
Domain	chathamhouse[.]eu	Chatham House lookalike; suspicious classification in the reported scan
Domain	chamber-ua[.]org	Ukrainian chamber-of-commerce lookalike
Domain	cdncounter[.]net	Reported actor infrastructure
Email	anna.manager[@]russianearabroad[.]net	Phishing persona address
Email	events[@]embassy-protocol[.]int	Phishing persona address

URLs and Endpoint Paths

Base address	Exact path and query	Purpose
hxxps://213[.]145[.]86[.]112	/t/pixel[.]gif?r=&m=stage2_entry8	Stage-two beacon
hxxps://213[.]145[.]86[.]112	/t/pixel[.]gif?m=stage2_ctx_admin_la_true&r=r=	Beacon carrying a context flag
hxxps://213[.]145[.]86[.]112	/s	Stager download
hxxps://213[.]145[.]86[.]112	/s?r=0f511e19	Stager download with session token
hxxps://213[.]145[.]86[.]112	/s?r=7ed4bb1d	First shortcut’s destination
hxxps://213[.]145[.]86[.]112	/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=0f511e19&stub=1	PowerShell stager disguised as JavaScript
hxxps://213[.]145[.]86[.]112	/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=95766022&stub=1	Second shortcut’s destination
hxxps://213[.]145[.]86[.]112	/cdn/chunks/polyfill-7e2b[.]min[.]js	Library fetched by the stager; file classified as clean
hxxps://213[.]145[.]86[.]112	/t/event	Microsoft-reported data-upload endpoint; not directly observed by RL
Same staging server	/WZ	Additional sandbox-referenced path; limited context

Host and Behavioral Hunting Indicators

Indicator	Context
%LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe	RL-observed backdoor installation path
svchost32.exe	Backdoor filename; also appears in unrelated malware
svchost32	Microsoft-reported Windows service name
Cloud Sync Service	Microsoft-reported service display name
.svchost32mid and .svchost32ul	Marker strings used in the source’s Go-backdoor YARA rule
stage2_entry and stage2_ctx_	Operator-chosen beacon labels used to connect stagers
collecting and key_abe_	Additional beacon labels seen in sandbox activity

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.