Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
ReversingLabs (RL) researchers recently identified and classified the malware that Anthropic disclosed in its September 2026 report on how the Russian-based threat group Midnight Blizzard was leveraging Anthropic’s Claude AI to rebuild- and redeploy flagged software implants, making them harder for victims to detect.
As noted in that report, RL had detected and tracked the malware samples for weeks before the Anthropic report was published — showing why behavioral intelligence and historical telemetry matter in the AI age. Since then we’ve been asked to explain more about the process we used to link Anthropic’s research to a much larger malicious campaign.
In this post, RL researchers walk through the two samples and the five pivots that turned them into a campaign map, then through the similarity analysis that ties the stagers together and a dated timeline. Every hash, URL, rule and query is in the indicators section at the end.
[ See report: What RL Found Before Anthropic’s Midnight Blizzard Report ]
To start its research, RL took the two malware hashes Anthropic published in its September 2026 case on GTG-20006, an espionage operator Anthropic links to Midnight Blizzard, and worked outward from them through RL telemetry.
Specifically, the two files led us to the operator’s staging server and to five more builds of the same server. They also led to a host of other revealing threat indicators. That included two lure files built to launch it; two files the server had served; and two resolution links between the cluster’s phishing domains and its servers. None of those indicators appear in Anthropic’s indicator appendix, and most of it is absent from Microsoft’s CaptiveCrunch report, which covers the same operation. But for defenders, such intelligence is critical.
As we noted in our first report on Midnight Blizzard, both of the malware “seed” files Anthropic provided hashes for were already in RL telemetry before either report. RL first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10. Microsoft published on July 31 and named the files CornFlake and ChocoShell; RL’s platform classified both as malicious on August 1; Anthropic published on September 10. Anthropic’s finding is that the operator used Claude to rebuild implants once security products flagged them, and RL’s data is consistent with that: five builds of the stager, with five different hashes, reached RL in 25 days.
The builds changed. What each build had to do – and the server it had to talk to– did not, and that is what made the campaign traceable.
Figure 1. How RL expanded Anthropic’s two published hashes. Each row shows one RL pivot and what is added. The red panel traces how the two delivery shortcuts were found and the stager URLs each one opens. The strip at the bottom counts what RL found that Anthropic’s appendix does not contain.
Anthropic’s Threat Intelligence Report, September 2026 describes GTG-20006 as a Russian-speaking operator whose attribution is “consistent with public reporting linking the actor to Midnight Blizzard.” The cluster targeted more than 20 government, diplomatic, think-tank and defense-industrial organizations, mostly in Ukraine and Europe, stole Microsoft 365 access through device-code phishing run from a framework Anthropic calls “Embassy Kit,” and, according to Anthropic, “used Claude to systematically identify, modify and redeploy the detected artifacts” when its implants were flagged. Anthropic’s appendix lists 209 indicators: domains, 14 IP addresses, two email addresses and two file hashes.
Six weeks earlier, Microsoft published on the same infrastructure under the name CaptiveCrunch, attributing it to Storm-2945, which Microsoft assesses is “an operational sub-cluster of Midnight Blizzard.” Microsoft’s indicator list is shorter and overlaps Anthropic’s: the same two hashes, which Microsoft names CornFlake (the Go backdoor) and ChocoShell (the PowerShell stealer), the same four Microsoft 365 lookalike domains, three of the same servers and the beacon path. Microsoft also noted that the ChocoShell script “was authored with full developer comments” in a style that “suggest[s] the author might have leveraged AI-assisted code generation.”
Midnight Blizzard is also tracked as APT29, Cozy Bear and NOBELIUM. RL’s file analysis neither confirms nor contradicts either vendor’s attribution, so this post calls the cluster “Midnight Blizzard-linked” and treats the two reports as the starting point and builds on them without endorsing them.
Anthropic labels them “Malware hash” and “Windows Backdoor.” RL’s analysis gives them roles: a PowerShell stager that gets a foothold and reports in, and a Go backdoor that persists and collects.
Field | PowerShell stager (ChocoShell) | Go backdoor (CornFlake) |
|---|---|---|
SHA-256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 |
File name in RL | 123.ps1 | 123.exe |
Type and size | Text/PowerShell, 54.6 KB | PE32+ (x64) GUI, Go, 7.7 MB |
RL first seen (UTC) | 2026-07-10 23:36 | 2026-07-06 23:54 |
The stager file hides its window and changes the PowerShell execution policy. It decodes and runs Base64-encoded code and collects browser history with public PowerSploit and Empire code. It enumerates shadow copies through WMI, runs work in background jobs, and reports to a staging server at 213[.]145[.]86[.]112 through HTTPS requests to a tracking-pixel path, /t/pixel[.]gif, whose query string names the stage the script has reached. Microsoft’s description of ChocoShell matches: a hardcoded C2 at that address, beacons on /t/pixel.gif?m=<status>, exfiltration by HTTPS POST to /t/event, and browser credential theft that includes a Chrome App-Bound Encryption bypass. RL’s sandbox saw that last part from the outside: among 38 network references the stager produced, the status labels include m=collecting and m=key_abe_.
The backdoor file copies itself to %LOCALAPPDATA%32.exe, writes an HKCU Run value, instantiates a Schedule.Service COM object as a second persistence path, injects into a suspended process, and reads Edge, Chrome and Firefox profile data along with the Microsoft Teams cache. Sandbox analysis produced a keylogger YARA hit and DirectInput and raw-input device creation. Microsoft’s CornFlake description adds a Windows service named “svchost32” with the display name “Cloud Sync Service” and gives the install path as %APPDATA%32.exe, so the path differs by one folder level between the two analyses. Anthropic describes a server holding stolen browser data; RL assesses with moderate confidence that this backdoor is the cluster’s collection component.
Figure 2. Spectra Analyze summaries for the two seed samples. Note the first-seen dates in the header bar: July 10, 2026 for the PowerShell stager and July 6, 2026 for the Go backdoor, ahead of both public reports.
Figure 3. Classification components for the Anthropic-listed stager in Spectra Analyze. Note the Spectra Core machine learning and RICC results alongside threat reputation; the same three components appear on every stager build RL found.
Each of those behaviors is also a place to look. A stager that reports home carries its server address. A server that hosts payloads leaves download records. A victim who has to click something needs a lure file.
The next five sections follow those leads in the order RL researchers worked them (Figure 1).
Content extraction in Spectra Intelligence pulled the staging server address and the beacon URLs out of the stager script. The query-string labels, stage2_entry and stage2_ctx_ followed by context flags, are operator choices. Nothing in PowerShell, PowerSploit or HTTP requires them to be spelled that way, and they have to match the server-side code that parses them, so changing them means changing two systems at once.
RL’s network data on the server itself was thin at that point. 213[.]145[.]86[.]112 is a bare metal server at Latitude.sh (AS396356) in New York. It carried no RL classification, and was flagged by just one third-party source, CyRadar, before Microsoft’s report. It entered RL’s telemetry on July 10 at 02:00 UTC, when RL first retrieved a file from it. The next three pivots supplied the connections that gave the server its meaning.
RL researchers wrote a YARA rule on the beacon path and the two stage labels, required two PowerShell execution primitives so that indicator lists and blog posts would not match, and ran it as a retro-hunt in Spectra Analyze. It returned seven files, all PowerShell, all classified malicious, none classified goodware, suspicious or unknown. One is the Anthropic-listed stager. Five are catalogued in IOC section C as the rebuilt stagers; the earliest reached RL on July 9, a day before the stager Anthropic listed. The seventh is a close, fuzzy-hash match to one of the five and is listed pending a capability comparison.
Figure 4. Retrohunt result in Spectra Analyze for RL’s beacon-label YARA rule. Note the malicious count and the empty goodware, suspicious and unknown columns.
Figure 5. Ruleset details for the same rule. Note seven matched samples, all PowerShell, including the Anthropic-listed stager and the seventh match listed last in IOC section C.
Not every one of those five is tied to the cluster equally, and the next pivot is what separates them.
File provenance in Spectra Intelligence records where RL retrieved a file from. A uri-source query for anything retrieved from the staging server returned four files. Two are stagers from the retro-hunt: one served at /s on July 15, the other at /cdn/chunks/vendor-9f3a1c[.]min[.]js on July 20, disguised as a JavaScript bundle. The other two are copies of polyfill-7e2b.min.js, a 34 KB JavaScript library served from the same /cdn/chunks/ path, which RL classifies as goodware. Microsoft lists that polyfill path as a ChocoShell “tooling fetch.” Whether the operator served a genuine library as cover or as a dependency, the path is part of the stager’s traffic, and the URL for it is classified malicious in RL’s network data.
Those two served stagers, plus the two lure files in the next section, are the files RL ties to the cluster with high confidence, because they were hosted on or point to infrastructure both Anthropic and Microsoft attribute to it. The other three retro-hunt stagers share the code and the beacon labels but have no observed network link, so our confidence that they come from the same operator is moderate; a second party reusing the stager template cannot be excluded. No file RL found should be called “Midnight Blizzard malware” on RL’s authority.
A uri-static query for any file that embeds a URL on the staging server returned two Windows Internet Shortcut (.url) files and four indicator documents. Each shortcut is 60 bytes. Each holds nothing but a link to a stager path on the server with its own session token: one opens /s?r=7ed4bb1d, the other opens the fake JavaScript bundle path with ref=95766022. The paths match the ones RL saw serving stagers in July, and RL first saw the shortcuts on July 14 and July 17, between the two retrievals. We assess these are the user-facing steps of the infection chain (Figure 1 red panel). The shortcuts also expose a gap, and it is RL’s own. They contain no code, so none of 37 antivirus engines flags either one, and RL’s consensus-based cloud verdict on both was still goodware on September 28. In other words: their malicious intent is based on where they point, not what they contain. RL’s extensive relationship data supplied what the verdict could not.
Figure 6. Spectra Intelligence summary for one delivery shortcut, a file that exists only to launch the stager. None of the 37 community detections of the file identified the file as malicious.
Anthropic lists the cluster’s domains and servers in separate sections, with no relationships between them. Spectra Intelligence resolution data supplies two: ms365-live[.]com resolves to 104[.]145[.]210[.]184, the device-code phishing server, and owa-ms365[.]com resolves to 31[.]57[.]243[.]154, the phishing host. Microsoft’s report lists the same two domains and the same two addresses, also without the resolution between them.
The backdoor produced one more lead. RL relationship data lists the Anthropic-published Go backdoor under “Files Communicating with IP” for 192[.]142[.]52[.]31, a Madrid address at Ultahost, the provider behind the cluster’s phishing VPS as well. The address is in neither report and carries no RL classification. Three more files reference it: a 12.9 MB text file RL classifies as Text.Hyperlink.Homoglyph and two documents from August 22 that also list the stager host. We assess with moderate confidence that the address is infrastructure the backdoor uses, and we list it as a hunting lead to validate before any blocking.
One pivot is worth reporting because it failed. A plain string search for the staging server address returned 82 files over a year, almost all indicator documents published after August 4, along with an Allaple worm doing random scanning. None of the retro-hunt stagers appeared, because they do not embed the address as a literal string. Every pivot that worked followed a relationship between artifacts; the string search looked for an artifact itself.
The five rebuilt stagers carry five different hashes. In RL’s analysis they carry one identical 35-item capability profile, the same MITRE ATT&CK tactic profile (Defense Evasion 6, Discovery 4, Execution 4), and the same three classification components: a Spectra Core machine-learning verdict, a Spectra Core RICC match for PowerSploit and Empire collection code, and threat reputation.
Fuzzy hashing splits them in two. By ssdeep, the Anthropic-listed stager groups with 154d8cfd9e304b66..., 1b97e0df9600335b..., 7acb7082d3785487... and 99f2eac2f00451a9... at similarity scores of 88 to 100. 04b64591837c5c26... matches none of them and pairs only with the seventh YARA match, 6e5c658261f72fda..., at 82. The operator made at least one code change large enough to break fuzzy-hash similarity, and the change did not touch the window hiding, the Base64 execution, the browser-history collection or the beacon labels. Spectra Analyze limits ssdeep searches to the last month regardless of the time filter, so those match sets are a floor, and TLSH was too loose on text files of this size to add anything.
The build-time signals that ought to connect related files did the opposite here, and the reason is worth one paragraph. The Go backdoor’s import hash matches 12.0K goodware-classified and 6.9K malicious-classified files in RL telemetry over the past year, because Go programs built with the same toolchain import the same functions regardless of purpose. Its install filename, svchost32.exe, appears in 14 unrelated malicious files over the same window. RHA, RL’s functional-similarity search, returned about 19,500 files for the backdoor across dozens of families and zero for the stager. A rebuild changes compiler and naming fingerprints at no cost to the operator.
Figure 7. Spectra Analyze Timeline for the stager (left) and the Go backdoor (right), captured September 28, 2026. Note the July first-seen entries at the top and the first MALICIOUS classifications on August 1.
Date (UTC) | Event |
|---|---|
2026-07-06 23:54 | Go backdoor first seen by RL |
2026-07-09 18:48 | Earliest rebuilt stager arrives via an external feed |
2026-07-10 02:00 | RL first retrieves a file from the staging server |
2026-07-10 23:36 | Anthropic-listed stager first seen by RL |
2026-07-13 to 07-21 | Three more stagers first seen; both delivery shortcuts first seen (07-14, 07-17) |
2026-07-15, 07-20 | RL retrieves stagers from /s and from the fake JavaScript path |
2026-07-31 |
Two things about that table need saying plainly.
Third-party reputation on this infrastructure was thin and late. Of the 14 servers Anthropic lists, 13 were flagged by 0 to 5 of roughly 49 sources when RL checked them on September 21 and 23, and the staging server was at 6 of 50 by September 24, with only CyRadar flagging it before Microsoft’s report. Of 61 cluster domains RL classifies as malicious, the median is flagged by 2 of about 47 sources. That is the wrong place to look for a verdict on this cluster, and the indicators carry better signals.
Every domain in the set that RL could characterize is a lookalike. Four impersonate Microsoft 365 sign-in and Outlook Web Access (ms365-live[.]com, owa-ms365[.]com, ms365-device[.]com, m365-owa[.]com); Microsoft confirms the first two as device-code redirect hosts and the second two as adversary-in-the-middle infrastructure. One impersonates WhatsApp Web pairing (wa-meeting[.]com). Two impersonate the targets’ own institutions: chathamhouse[.]eu for the London think tank and chamber-ua[.]org for a Ukrainian chamber of commerce. The two sender addresses impersonate a Russian expatriate organization and an embassy protocol office. The naming alone matches the victim profile Anthropic describes.
The infrastructure sits on rented capacity across five providers in four countries:
The lookalike domains that are still up front themselves with Cloudflare. The stager beacons to a raw IP on bare metal with no domain in front of it, which is commodity tradecraft and a detectable one: an HTTPS request to a raw IP for a tracking-pixel path is the pattern the Sigma rule in IOC section H keys on.
Microsoft’s July 31 indicator list and Anthropic’s September 10 appendix share the four M365 domains, three servers and both hashes, and Microsoft’s list adds three servers that Anthropic’s does not: 107[.]189[.]26[.]194, which Microsoft labels a second ChocoShell C2 and a DNS resolver, 104[.]194[.]159[.]150 and 38[.]146[.]28[.]132. RL has not yet enriched those three; they are queued with the URL scans in editor note 9.
Figure 8. Third-party reputation for the stager server in Spectra Analyze on September 24, 2026. Note “No Classification” at the top and the detection times: one source two months ago, five within the last two weeks.
RL researchers ran Spectra Analyze URL analysis on the staging-server paths and the cluster’s domains on October 5, 2026, eight weeks after Microsoft’s report and almost four after Anthropic’s. The staging server answered HTTP 200 on /s, on the shortcut target /s?r=7ed4bb1d and on the fake JavaScript bundle path, and each of those requests downloaded one file RL classifies malicious; the polyfill path answered 200 with a goodware file.
RL classifies every one of those URLs as malicious (Web.Hyperlink.Blacklisted), while just 2 or 3 of 50 third party reputation sources does so.
The phishing domains are in the same state: ms365-live[.]com (created 2026-05-14, now behind Cloudflare), wa-meeting[.]com (Cloudflare) and chamber-ua[.]org (RouterHosting, registered 2026-02-16) all answered 200, chathamhouse[.]eu answered 200 and is classified suspicious (Web.Hyperlink.Spam), and owa-ms365[.]com returned 403 from the Latitude.sh phishing host. Ten of the 21 URLs had finished analysis at capture time; the rest are listed as pending in IOC section D.
Figure 9. Spectra Analyze URL analysis on October 5, 2026 for the stager download path (top), the Outlook Web Access lookalike (middle) and the Ukrainian chamber lookalike (bottom). Note the HTTP 200 on the stager path with one malicious downloaded file, the Latitude.sh LTDA serving address behind the OWA lookalike, and the third-party-reputation classification reason on all three.
Internet Shortcut (.url, 60 bytes) [user opens; assessed from the shortcut contents]
└── HTTPS GET hxxps://213[.]145[.]86[.]112/s?r=<token>
or hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=<token>&stub=1
└── PowerShell stager (hidden window, execution-policy change, Base64 decode and execute)
├── fetches /cdn/chunks/polyfill-7e2b[.]min[.]js (goodware library; "tooling fetch" per Microsoft)
├── PowerSploit/Empire browser-history collection, WMI shadow-copy enumeration
├── HTTPS beacon /t/pixel[.]gif?m=stage2_entry | stage2_ctx_<flags> | collecting | key_abe_<...>
└── HTTPS POST /t/event (exfiltration, per Microsoft)
Go backdoor, svchost32.exe [delivery path not observed by RL]
├── copies itself to %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe
├── HKCU Run value and Schedule.Service COM object (Microsoft: also a "Cloud Sync Service" Windows service)
├── suspended-process injection
├── Edge, Chrome, Firefox profile and Microsoft Teams cache access; keylogger and raw-input device
└── network contact with 192[.]142[.]52[.]31 (RL relationship data; not in either public report)
RL observed the shortcut contents, the served stagers, the beacons and the backdoor’s host behavior directly. RL did not observe how the Go backdoor reaches a host, and did not observe a link between the stager and the backdoor. As it turns out, the two are connected through the two vendors’ listing of both for the same cluster. Microsoft’s chain for CaptiveCrunch starts further upstream, at compromised hotel- and venue captive portals that redirect travelers to the phishing domains and to ClickFix pages that deliver the malware. RL’s telemetry does not reach that layer. However, nothing in it contradicts what RL reported.
The YARA rule that ran the retro-hunt and a second rule for the Go backdoor are in IOC section G, with the Sigma rules for the backdoor’s install path and the beacon pattern in section H.
The PowerShell rule keys on the beacon path and the stage labels because the operator chose them and because they have to match server-side code; it survived two code variants that fuzzy hashing cannot connect. Validate both rules against a goodware corpus before deploying them, and note that the extra beacon labels RL’s sandbox observed (collecting, key_abe_) are not in the published rule.
To sum up, the following are the main discoveries from RL’s retro-hunt following the release of Anthropic’s report:
In light of the observations above, here are some recommended actions your organization can take to respond to the finding of Anthropic’s Midnight Blizzard report, as well as similar reports issued by other vendors and suppliers.
All indicators are TLP:CLEAR. Items marked RL were identified by RL and are not in Anthropic’s appendix; items marked Microsoft come from the CaptiveCrunch report and were not independently observed by RL. The full Anthropic indicator set is in the source report.
Field | PowerShell stager | Go backdoor |
|---|---|---|
SHA-1 | 937e75e0e1c82eecab69e9b8ad481bd7e0845308 | 510af9bb00ff5d4a6856b1291af55db9f6e13551 |
MD5 | c6f4df18cb880500f3921a179c3a3766 | fba867df17721879df9d8dcca68d6900 |
Anthropic label | “Malware hash” | “Windows Backdoor” |
Key behaviors | Hidden window, Base64 execute, execution-policy change, PowerSploit/Empire browser-history collection, WMI shadow-copy enumeration, background jobs, HTTPS pixel beacon | Copies to %LOCALAPPDATA%32.exe, HKCU Run value, Schedule.Service COM, suspended-process injection, Edge/Chrome/Firefox profile and Teams cache access, keylogger YARA hit, DirectInput and raw input device |
The beacon’s ctx_admin_la_true value may report local administrator context; we assess that reading with low confidence.
Each row is one query RL researchers ran, in the order the body describes them. Ambiguous or failed results are kept.
Step | Pivot | Query or method | Result |
|---|---|---|---|
1 | Content extraction on the stager | Spectra Intelligence enhanced analysis | Beacon URLs on 213[.]145[.]86[.]112 with stage2_entry and stage2_ctx_ labels |
2 | Retro-hunt on beacon labels | YARA rule RL_MidnightBlizzard_GTG20006_PowerShell_PixelBeacon_2026 (section G) in Spectra Analyze | Seven malicious matches, zero goodware, suspicious or unknown (Figures 4 and 5). Six are listed in section D; the seventh is SHA-1 6e5c658261f72fda92d475ac96f0213159af785d (Script-PowerShell.Trojan.Boxter, Text/PowerShell, 58.0 KB). Its SHA-256 is 28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3; first seen 2026-08-03 00:39 UTC, 11 of 23 community detections, same ATT&CK tactic profile as the other stagers. Its ssdeep hash matches only 04b64591837c5c26... (score 82), so it is a second build of that variant. No network link observed; listed in section D as same toolset |
8 | Beacon status labels | Stager sandbox network references (38 URLs) | Beyond stage2_entry and stage2_ctx_: m=collecting..., m=key_abe_s..., and a /WZ path, all on the staging server. Not in the published YARA rule |
9 | URL analysis | Spectra Analyze Submit, URL Analysis, plus the uri: search “View Network Page” for each URL | Pending (editor note 9): the eight staging-server URLs, eight phishing domains, 192[.]142[.]52[.]31 and the three Microsoft-only servers |
Rebuilt stagers (RL)
SHA-256 | SHA-1 | RL first seen (UTC) | Third-party AV | Link to 213[.]145[.]86[.]112 |
|---|---|---|---|---|
ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25 | 154d8cfd9e304b6644216456759b7fd12daf85c1 | 2026-07-09 18:48:52 | 12 / 38 | Retrieved from hxxps://213[.]145[.]86[.]112/s on 2026-07-15 |
20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38 | 7acb7082d37854877a08999374460c9d7e5cd663 | 2026-07-13 19:08:56 | 12 / 24 | None observed |
All five are PowerShell scripts of about 57 to 58 KB with an identical 35-item capability profile, and all arrived together in one external feed batch on 2026-08-21. Third-party family names on them (Boxter, Infostealer.Heuristic) are bulk heuristics with more than 20,000 hits in 2026 and carry no attribution weight. The seventh match has the same type and size and is a close ssdeep match to 04b64591837c5c26...; it is listed here pending a capability-profile comparison.
Delivery shortcuts (RL)
SHA-256 | SHA-1 | RL first seen (UTC) | Embedded network IOCs |
|---|---|---|---|
5bc3c615da8dd7ef45e421d26a97644679ba0a0647b24efc96ebed8348f403d2 | 9c5c539138df6cfcd854c55316bb527520025928 | 2026-07-14 14:38:28 | 213[.]145[.]86[.]112, hxxps://213[.]145[.]86[.]112/s?r=7ed4bb1d |
92cf0b883d220ba37f5ab378920fefdfdddc4fa76ee6c046696a7e5853a95c33 | e82a7c86677c5752dceb6b848754698571fb0aa8 | 2026-07-17 18:11:30 | 213[.]145[.]86[.]112, hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=95766022&stub=1 |
Both shortcuts are malicious. RL’s cloud verdict on them was still goodware on the 2026-09-28 recapture (threat reputation, trust factor 5), based on antivirus consensus alone.
Attribution tiers
Files | Tier | Assessment |
|---|---|---|
Both seed samples | Listed by Anthropic and Microsoft | Anthropic lists both for GTG-20006; Microsoft names them CornFlake and ChocoShell; RL extracts the stager’s beacon to the listed server |
154d8cfd9e304b6644216456759b7fd12daf85c1, 1b97e0df9600335b0cd8db2eb4577d3dbf6e76db, both shortcuts | Infrastructure-linked | High confidence they were hosted on, or point to, infrastructure both Anthropic and Microsoft attribute to the cluster |
7acb7082d37854877a08999374460c9d7e5cd663, 99f2eac2f00451a9a55521905add54205e336b9d, 04b64591837c5c2696c2a4423b1bb3dab00a0f01, 6e5c658261f72fda92d475ac96f0213159af785d | Same toolset | Moderate confidence same operator; a second party reusing the stager template cannot be excluded |
IP (defanged) | Anthropic role | Hosting | RL first seen | Third-party malicious |
|---|---|---|---|---|
213[.]145[.]86[.]112 | Operator/operational infrastructure; Microsoft: ChocoShell C2 | Latitude.sh, US | 2026-07-10 | 6 / 50, malware-associated |
104[.]145[.]210[.]184 | Embassy Kit device-code phishing VPS; Microsoft: CaptiveCrunch device-code redirect host via ms365-live[.]com | Ultahost, US | 2025-12-12 | 1 / 50 |
31[.]57[.]243[.]154 |
The remaining eight listed IPs score 0 to 5 of 49 to 50 sources, none malware-associated; three first appeared in RL telemetry on 2026-09-21 and 09-22. Microsoft’s CaptiveCrunch list adds 107[.]189[.]26[.]194 (ChocoShell C2 and DNS resolver), 104[.]194[.]159[.]150 and 38[.]146[.]28[.]132 (DNS resolver), which RL has not yet enriched.
The delivery shortcuts show the same gap from the file side. They contain no code, so none of 37 antivirus engines flag them, RL’s cloud verdict on them is goodware, and URL reputation had no record of their targets until RL queried them. Their malice is entirely in where they point.
The domains followed the pattern over a longer period. Of the 61 domains in Anthropic’s appendix that RL now classifies as malicious, 48 were already in RL telemetry before publication and 43 more than a month before. The median domain is still flagged by only 2 of about 47 reputation sources. The capabilities in the files, and the relationships linking those files to domains and servers, supplied the context that reputation scores did not.
Domain metric (61 domains RL classifies malicious, from 64 domain rows in the CSV) | Value |
|---|---|
In RL telemetry before 2026-09-10 | 48 |
More than 30 days before | 43 |
Earliest GTG-20006 first-seen (wa-meeting[.]com) | 2025-03-25, before Anthropic’s reporting window; may reflect earlier ownership |
Median third-party sources flagging each domain | 2 of about 47 |
Flagged by two or fewer sources | 42 |
A first-seen date records when RL observed a domain and says nothing about its classification at that time.
URL analysis, 2026-10-05 (Spectra Analyze, cloud crawl, depth 1)
URL or domain | RL classification | Serving IP and host | HTTP | Downloaded files | Third-party |
|---|---|---|---|---|---|
hxxps://213[.]145[.]86[.]112/s | malicious, Web.Hyperlink.Blacklisted | 213[.]145[.]86[.]112, Latitude.sh AS396356 | 200 | 1 malicious (154d8cfd9e304b66... references this URL) | 3 / 50 |
hxxps://213[.]145[.]86[.]112/s?r=7ed4bb1d | malicious, Web.Hyperlink.Blacklisted | same | 200 |
The Latitude.sh and RouterHosting entries put Anthropic’s phishing host, the staging server, two lure domains and one Microsoft-only server on two providers. Downloaded-file counts are RL’s classification of what the crawl retrieved; “n/a” means the third-party count was not read from the capture.
All IOCs and indicators in this blog post can be found in our GitHub repository [LINK]. The following is a subset for reference.
Indicator | Type | Description |
|---|---|---|
hxxps://213[.]145[.]86[.]112/t/pixel[.]gif?r=&m=stage2_entry8 | URL | RL. Stage-2 beacon from the PowerShell stager |
hxxps://213[.]145[.]86[.]112/t/pixel[.]gif?m=stage2_ctx_admin_la_true&r=r= | URL | RL. Stage-2 beacon with context flag |
hxxps://213[.]145[.]86[.]112/s | URL | RL. Stager download path |
hxxps://213[.]145[.]86[.]112/s?r=0f511e19 | URL | RL. Stager download with session token |
Hunting lead (validate before blocking): 192[.]142[.]52[.]31 (Ultahost, Madrid, RL first seen 2026-09-06, 2 of 50 sources, no RL classification). RL relationship data lists the Go backdoor under “Files Communicating with IP” for it, and three further files reference it. It is in neither public report. We assess with moderate confidence that it is infrastructure the backdoor uses.
Mapped to ATT&CK Enterprise [CONFIRM CURRENT VERSION]. Techniques marked report come from Anthropic’s or Microsoft’s description of the cluster.
Technique | ID | Description |
|---|---|---|
Phishing: Spearphishing Link | T1566.002 | Report. Device-code phishing through M365 lookalike domains (“Embassy Kit”) |
Steal Application Access Token | T1528 | Report. M365 token theft through the device-code flow |
User Execution: Malicious File | T1204.002 | Internet Shortcut files that open the stager URL (assessed) |
Ingress Tool Transfer | T1105 | Stager retrieved over HTTPS from the staging server |
An ATT&CK Navigator layer is available on request.
Hunting-grade rules. Strings come from artifacts RL extracted from the samples, not full disassembly. Validate against the samples and a goodware corpus before production use.
import "pe"
rule RL_MidnightBlizzard_GTG20006_PowerShell_PixelBeacon_2026 {
meta:
description = "Detects PowerShell stager beaconing with stage labels in a pixel.gif query string, as seen in Midnight Blizzard-linked GTG-20006 sample 123.ps1"
author = "Igor Lasic, ReversingLabs"
date = "2026-09-25"
reference = "https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure"
hash = "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c"
score = 70
strings:
// Rationale: beacon path and stage labels are operator-chosen and survived across five rebuilt stagers
$p1 = "/t/pixel.gif" ascii wide nocase
$s1 = "stage2_entry" ascii wide nocase
$s2 = "stage2_ctx_" ascii wide nocase
// Rationale: require real PowerShell execution primitives to keep IOC reports and blog text out
$ps1 = "FromBase64String" ascii wide nocase
$ps2 = "Invoke-Expression" ascii wide nocase
$ps3 = "IEX" ascii wide
$ps4 = "Start-Job" ascii wide nocase
// Exclusion: this rule's own text and published rule sets
$self = "rule RL_MidnightBlizzard_GTG20006" ascii
condition:
filesize < 200KB and
$p1 and 1 of ($s*) and 2 of ($ps*) and
not $self
}
rule RL_MidnightBlizzard_GTG20006_Go_Svchost32_Backdoor_2026 {
meta:
description = "Detects Go x64 backdoor using kardianos/service that installs as svchost32.exe under LocalAppData\\Microsoft, as seen in Midnight Blizzard-linked GTG-20006"
author = "Igor Lasic, ReversingLabs"
date = "2026-09-25"
reference = "https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure"
hash = "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593"
score = 60
strings:
// Rationale: Go build ID plus the three modules identified by static decomposition
$go = "Go build ID:" ascii
$m1 = "github.com/kardianos/service" ascii
$m2 = "github.com/fsnotify/fsnotify" ascii
$m3 = "github.com/go-ole/go-ole" ascii
// Rationale: install name and marker-file names observed in the sandbox; confirm they are static strings
$n1 = "svchost32" ascii wide
$n2 = ".svchost32mid" ascii wide
$n3 = ".svchost32ul" ascii wide
condition:
pe.is_pe and pe.is_64bit() and
$go and all of ($m*) and
($n1 and 1 of ($n2, $n3))
}The PowerShell rule keys on the beacon path and stage labels because the operator chose them and they persisted across all five rebuilt stagers; its retro-hunt returned only malicious files. Security content that quotes the URL is the main false-positive risk, so the rule also requires two PowerShell execution primitives, caps file size and excludes its own text. The Go rule is weaker: the module combination is common in legitimate Go service agents, so the svchost32 strings do the discriminating work. Confirm they exist as static strings before relying on the rule, and test it against internal Go tooling and IT management agents.
title: Executable Launched From Fake svchost32 Folder Under LocalAppData Microsoft
id: 7c1d4e2a-5b8f-4a3e-9d61-2f0b8c7e4a19
status: experimental
description: Detects execution of svchost32.exe from %LOCALAPPDATA%\Microsoft\svchost32\, the install path of a Midnight Blizzard-linked (GTG-20006) Go backdoor analyzed by RL
references:
- https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure
- https://www.anthropic.com/threat-intelligence-report-september-2026
author: Igor Lasic, ReversingLabs
date: 2026-09-25
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1036.005
- attack.t1547.001
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\AppData\Local\Microsoft\svchost32\svchost32.exe'
condition: selection
falsepositives:
- None known; svchost32.exe is not a Windows component
level: high
title: PowerShell Script Block With Raw-IP Pixel Beacon And Stage Labels
id: 3e9a7f10-8c2d-4b6e-a5f1-6d0c9b2e7a44
status: experimental
description: Detects PowerShell script block content matching the Midnight Blizzard-linked (GTG-20006) stager pattern of an HTTPS request to a raw IP pixel.gif path with stage labels
references:
- https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure
author: Igor Lasic, ReversingLabs
date: 2026-09-25
tags:
- attack.execution
- attack.t1059.001
- attack.command-and-control
- attack.t1071.001
logsource:
product: windows
category: ps_script
definition: 'Requires Script Block Logging'
detection:
selection_beacon:
ScriptBlockText|re: 'https?://\d{1,3}(\.\d{1,3}){3}/t/pixel\.gif'
selection_stage:
ScriptBlockText|contains:
- 'stage2_entry'
- 'stage2_ctx_'
condition: selection_beacon and selection_stage
falsepositives:
- Analyst tooling or scripts that embed published IOC strings
level: high
sha256:918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
uri-source:"https://213.145.86.112/*"
uri-static:"https://213.145.86.112/*"
uri-static:"*stage2_entry*"
ipv4:213.145.86.112 classification:malicious
filename:svchost32.exe classification:malicious firstseen:[2026-06-01T00:00:00Z TO *]Explore RL’s Spectra suite: Spectra Assure for software supply chain security, Spectra Detect for scalable file analysis, Spectra Analyze for malware analysis and threat hunting, and Spectra Intelligence for reputation data and intelligence.
RL classification
malicious, Win32.Trojan.Malgent |
malicious, Win64.Trojan.Malgent |
Spectra Core results | ML Script-PowerShell.Malware.Heuristic; RICC Script-PowerShell.Hacktool.PowerSploitEmpire | ML Win64.Malware.Heuristic |
Third-party antivirus, dated | 3/38 (07-10), 8/29 (08-03) | 10/38 (07-07), 20/38 (07-08), 22/28 (08-03) |
Microsoft publishes CaptiveCrunch, naming CornFlake and ChocoShell and listing both hashes |
2026-08-01 05:41, 05:54 | RL classifies the backdoor, then the stager, malicious (Spectra Core by threat reputation and Spectra Intelligence); RL Cloud Sandbox verdicts follow within 25 minutes |
2026-08-03 00:39, 01:00 | Seventh YARA match and last rebuilt stager first seen, 21 minutes apart |
2026-09-10 | Anthropic publishes its report |
2026-09-21 to 09-22 | Three Anthropic-listed servers enter RL telemetry for the first time, from analyst lookups |
2026-10-05 | Spectra Analyze URL analysis: staging server still answers 200 and serves the stager; four of five analyzed phishing domains still up |
Build notes | n/a | kardianos/service 1.2.2, fsnotify 1.7.0, go-ole 1.3.0; imphash 4e2bd2c481372f7ab13b83b63b424e97 matches 12.0K goodware-classified and 6.9K malicious-classified files over the 365 days to 2026-09-28 (toolchain-generic) |
3
File provenance |
uri-source:"https://213.145.86.112/*" |
Two stagers retrieved by RL from the server, plus two genuine polyfill files served as cover |
4 | URL pivot | uri-static:"https://213.145.86.112/*" | Two Internet Shortcut files targeting stager paths; four reporting and IOC-list documents (not malware) |
5 | IP string search | ipv4:213.145.86.112 (1 year) | 82 files, mostly IOC documents after August 4; an Allaple worm (random-scanning noise); none of the retro-hunt files, which do not embed the IP |
6 | Resolution | Spectra Intelligence network reputation | ms365-live[.]com resolves to 104[.]145[.]210[.]184; owa-ms365[.]com resolves to 31[.]57[.]243[.]154 |
7 | Build-artifact pivots | imphash:4e2bd2c481372f7ab13b83b63b424e97 (goodware and malicious splits); filename:svchost32.exe classification:malicious | 12.0K goodware-classified and 6.9K malicious-classified files by imphash; 14 unrelated malicious files by filename, both over a 365-day window (2025-09-28 to 2026-09-28) |
7.1 | RHA similarity (similar-to:) on both seed hashes | similar-to:937e75e0e1c82eecab69e9b8ad481bd7e0845308; similar-to:510af9bb00ff5d4a6856b1291af55db9f6e13551 | Zero results for the stager; approximately 19,500 results (13.5K cloud, 6.0K local) for the backdoor, spanning many unrelated families; the cloud set splits into 13.0K malicious, 131 suspicious and 399 goodware-classified files. Read as further evidence of generic toolchain overlap, not a new lead |
7.2 | ssdeep / TLSH fuzzy-hash similarity on the five-stager toolset and the seventh YARA match | ssdeep:"<hash>"; tlsh:<hash> for each of the six PowerShell samples | ssdeep splits the six into two variants. Variant A: the Anthropic-listed stager plus 154d8cfd9e304b66..., 1b97e0df9600335b..., 7acb7082d3785487... and 99f2eac2f00451a9... (scores 88 to 100 against 154d8cfd9e304b66...). Variant B: 04b64591837c5c26... and the seventh match 6e5c658261f72fda... (82 against each other, no match to variant A). The beacon labels and ATT&CK tactic profile are the same across both variants. TLSH returns hundreds to nearly 2,000 loosely related matches (mostly unrelated Python/JavaScript packages at similarity scores in the high 40s to low 60s) and is not discriminating enough for match-count claims on a file this size. A1000 silently rescopes ssdeep queries to a one-month window server-side even with no time filter requested; these counts are a floor for the last month, not a total |
7.3 | TLSH similarity on both delivery shortcuts | tlsh:<hash> for each shortcut | Both lookups returned “Similarity lookup failed” in the A1000 UI. This is a capture gap, not a zero-match result, and is called out rather than silently omitted |
1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916
1b97e0df9600335b0cd8db2eb4577d3dbf6e76db |
2026-07-20 18:49:28 |
15 / 38 |
Retrieved from /s?r=0f511e19 and /cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=0f511e19&stub=1 on 2026-07-20 |
403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f | 99f2eac2f00451a9a55521905add54205e336b9d | 2026-07-21 00:45:41 | 13 / 24 | None observed |
6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97 | 04b64591837c5c2696c2a4423b1bb3dab00a0f01 | 2026-08-03 01:00 | 13 / 24 | None observed |
28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3 | 6e5c658261f72fda92d475ac96f0213159af785d | 2026-08-03 00:39 | 11 / 23 | None observed; seventh YARA match, capability profile not yet compared |
Phishing host; Microsoft: AitM infrastructure
Latitude.sh LTDA (formerly Maxihost), US |
2026-04-09 |
4 / 50 |
104[.]194[.]151[.]133 | Primary C2 VPS | Tornado Datacenter, UK | 2026-05-06 | 0 / 49 |
104[.]194[.]159[.]55 | C2 holding exfiltrated browser-data zips | RouterHosting, DE | 2026-08-05 | 0 / 49 |
38[.]146[.]28[.]75 | Notifier C2 for the phishing console; Microsoft: AitM infrastructure | Cogent, US | 2026-08-06 | 5 / 50 |
1 malicious
2 / 50 |
hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=0f511e19&stub=1 | malicious, Web.Hyperlink.Blacklisted | same | 200 | 1 malicious | 2 / 50 |
hxxps://213[.]145[.]86[.]112/cdn/chunks/polyfill-7e2b[.]min[.]js | malicious, Web.Hyperlink.Blacklisted | same | 200 | 1 goodware | 3 / 50 |
ms365-live[.]com | malicious, Web.Hyperlink.Blacklisted | 172[.]67[.]136[.]242, Cloudflare; domain created 2026-05-14 | 200 | 2 goodware | 3 / 49 |
owa-ms365[.]com | malicious, Web.Hyperlink.Blacklisted | 31[.]57[.]243[.]154, Latitude.sh LTDA AS262287; domain created 2026-07-16 | 403 | none | n/a |
wa-meeting[.]com | malicious, Web.Hyperlink.Blacklisted | 188[.]114[.]97[.]3, Cloudflare | 200 | 1 goodware | n/a |
chamber-ua[.]org | malicious, Web.Hyperlink.Phishing | 45[.]59[.]122[.]181, RouterHosting AS14956; domain created 2026-02-16 | 200 | 1 unknown | n/a |
chathamhouse[.]eu | suspicious, Web.Hyperlink.Spam | 107[.]189[.]24[.]79, RouterHosting AS14956 | 200 | 1 unknown | n/a |
104[.]194[.]159[.]150 (Microsoft) | malicious, Web.Hyperlink.Blacklisted | RouterHosting AS14956 | 200 | 1 goodware | n/a |
Pending at capture: both beacon URLs, /s?r=0f511e19, shortcut B’s target, /t/event, ms365-device[.]com, m365-owa[.]com, cdncounter[.]net, 192[.]142[.]52[.]31, 107[.]189[.]26[.]194, 38[.]146[.]28[.]132 | analysis in progress |
hxxps://213[.]145[.]86[.]112/s?r=7ed4bb1d
URL |
RL. Opened by shortcut 9c5c539138df6cfcd854c55316bb527520025928 |
hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=0f511e19&stub=1 | URL | RL. Stager disguised as a JavaScript bundle |
hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=95766022&stub=1 | URL | RL. Opened by shortcut e82a7c86677c5752dceb6b848754698571fb0aa8 |
hxxps://213[.]145[.]86[.]112/cdn/chunks/polyfill-7e2b[.]min[.]js | URL | RL. Polyfill library fetched by the stager; files classified goodware; Microsoft: ChocoShell tooling fetch |
hxxps://213[.]145[.]86[.]112/t/event | URL | Microsoft. ChocoShell exfiltration endpoint; not observed by RL |
213[.]145[.]86[.]112 | IPv4 | Stager hosting and beacon endpoint. Latitude.sh. Microsoft: ChocoShell C2 |
104[.]145[.]210[.]184 | IPv4 | Embassy Kit device-code phishing VPS; resolved by ms365-live[.]com |
31[.]57[.]243[.]154 | IPv4 | Phishing host; resolved by owa-ms365[.]com. Latitude.sh LTDA (formerly Maxihost) |
104[.]194[.]151[.]133 | IPv4 | Primary C2 VPS |
104[.]194[.]159[.]55 | IPv4 | C2 holding exfiltrated browser-data zips |
38[.]146[.]28[.]75 | IPv4 | Notifier C2 for the phishing console |
107[.]189[.]26[.]194 | IPv4 | Microsoft. Second ChocoShell C2 and CaptiveCrunch DNS resolver; not yet enriched by RL |
104[.]194[.]159[.]150 | IPv4 | Microsoft. CaptiveCrunch AitM infrastructure; not yet enriched by RL |
38[.]146[.]28[.]132 | IPv4 | Listed by Anthropic; Microsoft: CaptiveCrunch DNS resolver |
ms365-live[.]com | Domain | M365 lookalike, device-code phishing. RL first seen 2026-05-18 |
owa-ms365[.]com | Domain | M365 lookalike. RL first seen 2026-08-14 |
ms365-device[.]com | Domain | M365 lookalike. RL first seen 2026-07-25 |
m365-owa[.]com | Domain | M365 lookalike. RL first seen 2026-07-30 |
wa-meeting[.]com | Domain | WhatsApp Web pairing-code phishing. RL first seen 2025-03-25 |
chathamhouse[.]eu | Domain | Chatham House lookalike. RL first seen 2026-02-25 |
chamber-ua[.]org | Domain | Ukrainian chamber lookalike. RL first seen 2026-02-25 |
cdncounter[.]net | Domain | Actor infrastructure. RL first seen 2026-03-16 |
anna.manager[@]russianearabroad[.]net | Phishing persona address |
events[@]embassy-protocol[.]int | Phishing persona address |
Masquerading
T1036 |
Stager served under a fake JavaScript bundle name next to a polyfill library |
Command and Scripting Interpreter: PowerShell | T1059.001 | PowerShell stager; changes the execution policy to an insecure level |
Deobfuscate/Decode Files or Information | T1140 | Base64 decode and execute |
Hide Artifacts: Hidden Window | T1564.003 | PowerShell runs hidden and non-interactive |
Boot or Logon Autostart Execution: Registry Run Keys | T1547.001 | Go backdoor writes an HKCU Run value |
Scheduled Task/Job: Scheduled Task | T1053.005 | Schedule.Service COM object instantiated |
Masquerading: Match Legitimate Name or Location | T1036.005 | svchost32.exe mimics svchost.exe under *Local |
Process Injection: Process Hollowing | T1055.012 | Suspended process creation plus foreign memory and thread-context writes (assessed) |
Browser Information Discovery | T1217 | Empire-style browser history retrieval; profile enumeration |
Credentials from Password Stores: Web Browsers | T1555.003 | Sandbox signature for browser information theft |
Input Capture: Keylogging | T1056.001 | Keylogger YARA hit, DirectInput and raw input device creation |
Application Layer Protocol: Web Protocols | T1071.001 | HTTPS beacon to a raw IP with a tracking-pixel path |
New btree malware bypasses the install script, negating the popular repo's measure barely two months after adoption.
This post-mortem on recent supply chain attacks and threat actors including S1ngularity, Shai-Hulud and TeamPCP can help you prepare for what comes next.
The package poses as a security tool targeting developers looking to implement Internet-based apps with telecom networks.
