Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure

A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026.

The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows Internet Shortcut files to launch a PowerShell stager.

The finding shows that public disclosure and low reputation scores do not necessarily mean an operation’s infrastructure has been taken offline.

Microsoft tracks related activity as CaptiveCrunch and attributes it to Storm-2945, which it assesses as an operational sub-cluster of Midnight Blizzard.

RL says its file analysis neither confirms nor contradicts those attributions, and describes the activity as Midnight Blizzard-linked.

Starting with two malware hashes published by Anthropic, RL searched its historical telemetry and connected the samples to a staging server at 213[.]145[.]86[.]112.

The two files were a PowerShell stager, which Microsoft identified as ChocoShell, and a Go backdoor known as CornFlake.

RL had first observed the backdoor on July 6 and the stager on July 10 weeks before the public reports. It classified both as malicious on August 1, the day after Microsoft published its findings.

A behavioral hunt based on distinctive beacon paths and labels found five additional stager builds with different hashes.

Together, the samples shared a 35-item capability profile, including hidden PowerShell execution, Base64-decoded code execution, browser-history collection and beaconing to the same server.

ReversingLabs analysis expanded, on its earlier research into Anthropic’s September report on GTG-20006, an espionage operator Anthropic says is consistent with public reporting linking it to Midnight Blizzard.

Midnight Blizzard Malware

The five builds reached RL telemetry between July 9 and August 3, a pattern consistent with repeated rebuilding, though RL says its data cannot establish that AI produced them.

Anthropic reported that the operator used Claude to modify and redeploy implants after security products detected them.

Further pivots revealed two short Windows Internet Shortcut files pointing to stager download paths, two stagers retrieved from the server, and links between phishing domains and hosting addresses.

The shortcuts contained no executable code, so antivirus engines did not flag them; their malicious significance came from the URLs they opened.

RL also found the server hosting a file disguised as a JavaScript bundle, as well as a genuine polyfill library used in the campaign’s traffic.

During URL analysis on October 5, the staging server returned HTTP 200 for /s, a shortcut-specific /s URL and a fake JavaScript bundle path.

Each request delivered a file RL classified as malicious. Several related phishing domains also remained reachable, although one Outlook Web Access lookalike returned HTTP 403.

The results are a dated snapshot: they show the infrastructure responded during that analysis, not whether it remains active now.

The operation’s malware combines credential theft and persistence. Microsoft describes ChocoShell stealing browser data and Microsoft 365 tokens, while CornFlake provides a persistent remote-access capability and collects information from infected systems.

RL’s analysis independently observed the Go backdoor accessing browser profiles and Microsoft Teams data, and identified a possible additional server at 192[.]142[.]52[.]31 as a hunting lead not a confirmed indicator.

RL found that conventional reputation signals were weak: most of the servers it reviewed had few third-party detections.

That makes relationships between files, URLs, domains and infrastructure especially valuable. Hashes can change between builds, but behaviors such as beacon paths and collection routines can persist.

Microsoft’s broader CaptiveCrunch reporting describes traffic manipulation involving hospitality networks, captive portals and phishing, alongside malware delivery and device-code phishing targeting Microsoft 365 accounts.

Its October 5 update also reported renewed activity in late September, including a Rust variant of CornFlake.

The continuing activity underscores the need to investigate beyond published hashes: hunt for related behaviors and network connections, review suspicious PowerShell and credential access, and treat hotel or conference Wi-Fi prompts to install updates or run commands with caution.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.