Midnight Blizzard Uses Claude AI to Rebuild Malware, Evade Detection

Key Takeaways

• The state-backed hacking group Midnight Blizzard leveraged Anthropic’s Claude AI to reconstruct malware, including “ChocoShell” and “CornFlake,” to evade detection.
• The campaign targeted over 20 government, diplomatic, think tank, and defense organizations in Ukraine and Europe.
• AI was used for various attack stages, from code modification and phishing system development to malware updates and data exfiltration.
• Researchers traced the campaign by identifying shared behavioral patterns and infrastructure links, even when file hashes changed.
• Defenders should focus on behavioral analysis, network connections, and infrastructure blocking rather than relying solely on file hashes for detection.

Midnight Blizzard Utilizes Claude AI to Rebuild Malware and Bypass Security Measures

A sophisticated cyber espionage campaign attributed to the Russian state-sponsored hacking group Midnight Blizzard has been observed using Anthropic’s Claude AI to regenerate its malware. This tactic allowed the group to circumvent existing security detections, sustaining their operations against critical Ukrainian and European entities.

Despite modifications to file code and hashes, which are typically used for detection, new research indicates that the underlying behavioral patterns and server connections of the malware remained consistent. This persistence in operational characteristics enabled investigators to map the broader campaign, even after the initial malware samples were identified.

Anthropic, the developer of Claude AI, has designated this activity as GTG-20006. The company notes that the targeting and methodologies employed align with publicly reported information concerning Midnight Blizzard. The ongoing operation has reportedly targeted over 20 organizations across government, diplomatic missions, think tanks, and defense sectors.

The use of Claude AI by the attackers extended beyond merely rewriting malware code. It encompassed automating various phases of the attack lifecycle, including developing phishing systems, deploying malware updates, and facilitating the collection of stolen data.

Researchers from ReversingLabs identified and categorized the malware, subsequently expanding two initial file hashes into a comprehensive campaign map. Their October 15 research report connected the observed samples to a staging server, five additional PowerShell builds, two shortcut lures, and a network of phishing domains and command-and-control servers. However, ReversingLabs’ analysis of the files does not independently confirm the actor’s identity.

AI-Assisted Malware Regeneration Cycle

Anthropic confirmed that the threat actor leveraged Claude AI to locate, modify, and redeploy implants that had been detected by security tools. ReversingLabs’ investigation uncovered five additional stager builds deployed over a 25-day period, specifically between July 9 and August 3. This rapid succession of new builds suggests an active and continuous malware regeneration cycle. While the pattern aligns with an ongoing rebuild process, ReversingLabs’ internal records cannot definitively confirm whether these subsequent versions were generated by AI.

The initial samples that triggered the investigation were “ChocoShell,” a PowerShell stager, and “CornFlake,” a Windows backdoor written in Go. Microsoft previously identified both of these in its “CaptiveCrunch” report, linking the operation to Storm-2945, which Microsoft assesses as an operational subgroup of Midnight Blizzard. ReversingLabs first observed CornFlake on July 6 and ChocoShell on July 10.

It is important to note the timeline of these observations. ReversingLabs classified both files as malicious on August 1, which was one day after Microsoft publicly released its report. This classification was based on existing threat reputation. Therefore, ReversingLabs’ records indicate earlier possession of the samples, but not an independent malicious verdict preceding Microsoft’s disclosure.

Inside the ChocoShell and CornFlake Toolset

ChocoShell operates by concealing its window, altering PowerShell’s execution policy, and executing Base64-encoded commands. It leverages publicly available PowerSploit and Empire framework code to harvest browser history, query Windows shadow copies via WMI, and run background tasks. Its communication, conducted over HTTPS, reports operational progress through a tracking-pixel endpoint. Microsoft’s analysis also detailed the malware’s capability for browser credential theft and data uploads.

Investigators discovered two 60-byte Windows Internet Shortcut files that pointed to the staging server. One of these shortcuts led to a brief download path, while the other directed to a PowerShell payload disguised as a JavaScript bundle. Neither shortcut contained executable code, and none of the 37 antivirus engines tested flagged them as malicious. Their inherent danger stemmed solely from the malicious destinations they opened. Microsoft’s reporting suggests that compromised hotel and venue network portals were earlier in the attack chain, redirecting travelers to phishing pages and ClickFix prompts. ReversingLabs did not observe this upstream activity, so its shortcut findings should not be taken as independent confirmation of every step described by Microsoft.

CornFlake establishes persistent access through a registry startup entry and an additional mechanism involving Windows task scheduling. It injects itself into a suspended process and extracts browser profiles and cached Microsoft Teams data. Sandbox analysis also indicated signs of keylogging functionality. Crucially, ReversingLabs did not observe the initial delivery method for CornFlake to victims, nor could they establish a direct delivery link from ChocoShell.

The most significant commonality among the rebuilt stagers was their shared behavior. All five observed stagers exhibited an identical 35-item capability profile, despite having different file hashes. While some code changes were sufficient to break fuzzy-hash matching, which assesses file similarity, the same beacon labels persisted across versions. A YARA rule constructed using these consistent labels and PowerShell actions successfully identified seven malicious scripts, including the original sample.

Two additional stagers and both shortcut files demonstrated strong infrastructural ties to the campaign. Other scripts, while sharing the same toolset, lacked an observed network connection, suggesting the possibility of another operator using similar code. This distinction is critical for accurately attributing campaign activities versus merely identifying potential hunting leads.

As of checks conducted on October 5, the staging server continued to deliver malicious files. ReversingLabs advises organizations to review historical records, block confirmed malicious infrastructure, and scrutinize Microsoft Entra device-code sign-ins. The group’s prior focus on Teams chat credential theft highlights their broader objective of gaining account access. Organizations should restrict unused device-code authentication and test detection rules against benign files before deploying them.

The overarching lesson for defenders is to prioritize understanding malware’s behavior and its network connections, rather than relying solely on file hashes or low detection counts from external reputation services during active investigations.

What You Should Do

• Implement robust behavioral detection rules that focus on malware actions and network communications, not just file hashes.
• Block all confirmed malicious IP addresses, domains, and URLs identified in the Indicators of Compromise.
• Review historical logs for any signs of communication with the listed infrastructure or execution of the identified malware.
• Audit and restrict Microsoft Entra device-code authentication, ensuring only necessary accounts have this capability.
• Regularly test detection rules against both malicious and clean files to minimize false positives and ensure effectiveness before deployment.
• Educate users on phishing techniques, especially those involving device-code authentication and lookalike domains.

Indicators of Compromise (IoCs):-

File Hashes

The source also provides the following MD5 and import-hash values. The import hash matches many unrelated clean and malicious Go files, so it is not a reliable standalone detection indicator.

IP Addresses, Domains and Email Addresses

URLs and Endpoint Paths

Host and Behavioral Hunting Indicators

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.