Midnight Blizzard-Linked Hackers Reportedly Use Claude to Rebuild Detected Malware

Hackers linked to Midnight Blizzard reportedly used Anthropic’s Claude agents to modify, retest and redeploy malware after detection during espionage operations targeting more than 20 government, diplomatic, think tank and defense organizations in Ukraine and Europe. Anthropic tracks the activity as GTG-20006, describing it as consistent with public reporting on Midnight Blizzard; Microsoft links the associated CaptiveCrunch operation to Storm-2945, an assessed operational subgroup. The activity illustrates findings in Anthropic’s September 2026 threat report that attackers are using AI agents across reconnaissance, credential theft, lateral movement and exfiltration, while humans retain control of key decisions.

ReversingLabs expanded two published malware hashes into an investigation connecting ChocoShell PowerShell stagers, the CornFlake Go backdoor, malicious shortcuts and associated infrastructure. Shared capabilities and beacon labels helped investigators link rebuilt stagers despite changing hashes, but the researchers could not independently establish actor attribution, AI authorship or every reported delivery step. The findings support prioritizing behavior- and infrastructure-based hunting over hash-only detection, reviewing historical logs, blocking confirmed malicious infrastructure and scrutinizing Microsoft Entra device-code authentication. Anthropic said it banned accounts linked to the campaigns and strengthened safeguards.