Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
5
Stories per day · 30 days
2 RSS
Relatedchocoshell2cornflake2midnight-blizzard2powershell2anthropic1captivecrunch1claude1espionage1microsoft-3651threat-intel1
7 stories, newest first · one card per story
Stories tagged #storm-2945
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
6
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Midnight Blizzard’s CaptiveCrunch campaign abuses hotel Wi-Fi portals to deliver malware and steal cloud credentials.
5
From guidance to action: Security fundamentals that materially reduce risk
Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.
4
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
3
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
2