Hackers Linked to Midnight Blizzard Use Claude AI to Rebuild Malware and Evade Detection

Hackers tied to the Midnight Blizzard cluster used Anthropic’s Claude AI to rebuild malware after security tools detected it, allowing them to continue espionage operations against Ukrainian and European targets.

New analysis shows that changing a file’s code and hash did not remove the shared behaviors and server links that enabled investigators to map the campaign.

Anthropic tracks this activity as GTG-20006 and says the targeting and techniques align with public reporting on Midnight Blizzard. The operation targeted more than 20 government, diplomatic, think tank and defense organizations. The attackers’ use of Claude extended beyond generating code to automating phishing systems, updating malware, and helping collect stolen data.

Researchers at ReversingLabs identified and classified samples, then expanded two published file hashes into a broader campaign picture. Their October 15 report linked the samples to a staging server, five additional PowerShell stager builds, two Windows Internet Shortcut delivery lures, and multiple connections between phishing domains and backend servers. ReversingLabs’ file and behavioral analysis does not independently prove the actor’s identity.

Midnight Blizzard–linked attackers used Claude AI

Anthropic reported that the operator used Claude to find, modify and redeploy implants after detections. ReversingLabs found five additional stager builds across a 25-day window (July 9–August 3), a pattern consistent with an ongoing rebuild cycle; however, the researchers cannot confirm from their own records whether AI produced those versions.

The two initial samples were ChocoShell, a PowerShell stager, and CornFlake, a Windows backdoor written in Go. Microsoft named both in its CaptiveCrunch reporting and linked the activity to Storm-2945, which Microsoft assesses as an operational sub-group of Midnight Blizzard. ReversingLabs first observed CornFlake on July 6 and ChocoShell on July 10.

Early timeline details require careful interpretation. ReversingLabs labeled both files as malicious on August 1, one day after Microsoft published its report; that classification relied on threat reputation. ReversingLabs’ records therefore show earlier possession of the samples, not an independent malicious verdict predating Microsoft’s disclosure.

ChocoShell behavior

ChocoShell hides its window, modifies PowerShell’s execution policy and runs Base64-encoded payloads. It incorporates public PowerSploit and Empire modules to collect browser history, queries Windows shadow copies via WMI, and schedules background tasks. Its HTTPS communications use a tracking-pixel endpoint to report progress. Microsoft additionally reported browser credential theft and data uploads associated with these components.

Investigators recovered two 60-byte Windows Internet Shortcut (.lnk) files that pointed to the staging server. One shortcut referenced a short download path; the other pointed to a PowerShell payload disguised as a JavaScript bundle. Neither shortcut contained executable code, and none of 37 antivirus engines flagged them — their risk came from the destinations they opened. Microsoft’s reporting places compromised hotel and venue captive-portal networks earlier in the attack chain; those hotel Wi‑Fi attacks redirected travelers to phishing pages and ClickFix prompts. ReversingLabs did not observe that upstream captive-portal activity, so its shortcut findings should not be treated as proof of every step Microsoft described.

CornFlake behavior

CornFlake establishes persistence via a registry startup entry and a scheduled task. It injects into a suspended process and reads browser profile data and Microsoft Teams cache files. Sandbox runs showed signs consistent with keylogging. ReversingLabs did not observe how CornFlake was delivered to victims and could not establish a direct delivery link from ChocoShell to CornFlake.

The strongest linkage among the rebuilt stagers was behavioral: all five additional stagers shared the same 35-item capability profile despite having different hashes. Some code edits disrupted fuzzy-hash similarity detection, but consistent beacon labels remained. A YARA search built around those beacon labels and the PowerShell actions recovered seven malicious scripts, including the original sample.

Two of the additional stagers and both shortcuts had strong infrastructure ties. Other scripts shared the same toolset but lacked an observed network connection, leaving open the possibility of another operator reusing similar code. That distinction is important when separating findings that support campaign attribution from those that provide hunting leads.

ReversingLabs observed the staging server still delivering malicious files as of checks on October 5. The researchers recommend searching historical telemetry, blocking confirmed infrastructure, and reviewing Microsoft Entra device-code sign-ins. Prior Teams credential theft highlights the group’s emphasis on account access. Administrators should restrict unused device-code authentication flows and test detection rules against clean files before deployment.

The practical takeaway: focus on what malware does and where it connects, rather than relying solely on file hashes or low detection counts from reputation services during an active investigation.

Indicators of Compromise (IoCs)

File hashes

The source also provides these MD5 and import-hash values. The import hash is a common Go toolchain fingerprint and matches many unrelated clean and malicious Go files, so it is not a reliable standalone indicator.

IP addresses, domains and email addresses

URLs and endpoint paths

Host and behavioral hunting indicators

Note: IP addresses and domains above are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat‑intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with telemetry from your SOCs and XDR tools.