How RL mapped a Midnight Blizzard-linked campaign from two hashes

ReversingLabs (RL) researchers recently identified and classified the malware that Anthropic disclosed in its September 2026 report on how the Russian-based threat group Midnight Blizzard was leveraging Anthropic’s Claude AI to rebuild- and redeploy flagged software implants, making them harder for victims to detect.

As noted in that report, RL had detected and tracked the malware samples for weeks before the Anthropic report was published — showing why behavioral intelligence and historical telemetry matter in the AI age. Since then we’ve been asked to explain more about the process we used to link Anthropic’s research to a much larger malicious campaign. 

In this post, RL researchers walk through the two samples and the five pivots that turned them into a campaign map, then through the similarity analysis that ties the stagers together and a dated timeline. Every hash, URL, rule and query is in the indicators section at the end.

[ See report: What RL Found Before Anthropic’s Midnight Blizzard Report ]

File hashes with a lot to say

To start its research, RL took the two malware hashes Anthropic published in its September 2026 case on GTG-20006, an espionage operator Anthropic links to Midnight Blizzard, and worked outward from them through RL telemetry. 

Specifically, the two files led us to the operator’s staging server and to five more builds of the same server. They also led to a host of other revealing threat indicators. That included two lure files built to launch it; two files the server had served; and two resolution links between the cluster’s phishing domains and its servers. None of those indicators appear in Anthropic’s indicator appendix, and most of it is absent from Microsoft’s CaptiveCrunch report, which covers the same operation. But for defenders, such intelligence is critical. 

As we noted in our first report on Midnight Blizzard, both of the malware “seed” files Anthropic provided hashes for were already in RL telemetry before either report. RL first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10. Microsoft published on July 31 and named the files CornFlake and ChocoShell; RL’s platform classified both as malicious on August 1; Anthropic published on September 10. Anthropic’s finding is that the operator used Claude to rebuild implants once security products flagged them, and RL’s data is consistent with that: five builds of the stager, with five different hashes, reached RL in 25 days. 

The builds changed. What each build had to do – and the server it had to talk to– did not, and that is what made the campaign traceable.

Figure 1. How RL expanded Anthropic’s two published hashes. Each row shows one RL pivot and what is added. The red panel traces how the two delivery shortcuts were found and the stager URLs each one opens. The strip at the bottom counts what RL found that Anthropic’s appendix does not contain.

Two reports, two hashes

Anthropic’s Threat Intelligence Report, September 2026 describes GTG-20006 as a Russian-speaking operator whose attribution is “consistent with public reporting linking the actor to Midnight Blizzard.” The cluster targeted more than 20 government, diplomatic, think-tank and defense-industrial organizations, mostly in Ukraine and Europe, stole Microsoft 365 access through device-code phishing run from a framework Anthropic calls “Embassy Kit,” and, according to Anthropic, “used Claude to systematically identify, modify and redeploy the detected artifacts” when its implants were flagged. Anthropic’s appendix lists 209 indicators: domains, 14 IP addresses, two email addresses and two file hashes.

Six weeks earlier, Microsoft published on the same infrastructure under the name CaptiveCrunch, attributing it to Storm-2945, which Microsoft assesses is “an operational sub-cluster of Midnight Blizzard.” Microsoft’s indicator list is shorter and overlaps Anthropic’s: the same two hashes, which Microsoft names CornFlake (the Go backdoor) and ChocoShell (the PowerShell stealer), the same four Microsoft 365 lookalike domains, three of the same servers and the beacon path. Microsoft also noted that the ChocoShell script “was authored with full developer comments” in a style that “suggest[s] the author might have leveraged AI-assisted code generation.”

Midnight Blizzard is also tracked as APT29, Cozy Bear and NOBELIUM. RL’s file analysis neither confirms nor contradicts either vendor’s attribution, so this post calls the cluster “Midnight Blizzard-linked” and treats the two reports as the starting point and builds on them without endorsing them.

The seed samples

Anthropic labels them “Malware hash” and “Windows Backdoor.” RL’s analysis gives them roles: a PowerShell stager that gets a foothold and reports in, and a Go backdoor that persists and collects.

The stager 

The stager file hides its window and changes the PowerShell execution policy. It decodes and runs Base64-encoded code and collects browser history with public PowerSploit and Empire code. It enumerates shadow copies through WMI, runs work in background jobs, and reports to a staging server at 213[.]145[.]86[.]112 through HTTPS requests to a tracking-pixel path, /t/pixel[.]gif, whose query string names the stage the script has reached. Microsoft’s description of ChocoShell matches: a hardcoded C2 at that address, beacons on /t/pixel.gif?m=<status>, exfiltration by HTTPS POST to /t/event, and browser credential theft that includes a Chrome App-Bound Encryption bypass. RL’s sandbox saw that last part from the outside: among 38 network references the stager produced, the status labels include m=collecting and m=key_abe_.

The backdoor 

The backdoor file copies itself to %LOCALAPPDATA%32.exe, writes an HKCU Run value, instantiates a Schedule.Service COM object as a second persistence path, injects into a suspended process, and reads Edge, Chrome and Firefox profile data along with the Microsoft Teams cache. Sandbox analysis produced a keylogger YARA hit and DirectInput and raw-input device creation. Microsoft’s CornFlake description adds a Windows service named “svchost32” with the display name “Cloud Sync Service” and gives the install path as %APPDATA%32.exe, so the path differs by one folder level between the two analyses. Anthropic describes a server holding stolen browser data; RL assesses with moderate confidence that this backdoor is the cluster’s collection component.

Figure 2. Spectra Analyze summaries for the two seed samples. Note the first-seen dates in the header bar: July 10, 2026 for the PowerShell stager and July 6, 2026 for the Go backdoor, ahead of both public reports.

Figure 3. Classification components for the Anthropic-listed stager in Spectra Analyze. Note the Spectra Core machine learning and RICC results alongside threat reputation; the same three components appear on every stager build RL found.

Each of those behaviors is also a place to look. A stager that reports home carries its server address. A server that hosts payloads leaves download records. A victim who has to click something needs a lure file. 

The next five sections follow those leads in the order RL researchers worked them (Figure 1).

1. From the beacon URL to the staging server

Content extraction in Spectra Intelligence pulled the staging server address and the beacon URLs out of the stager script. The query-string labels, stage2_entry and stage2_ctx_ followed by context flags, are operator choices. Nothing in PowerShell, PowerSploit or HTTP requires them to be spelled that way, and they have to match the server-side code that parses them, so changing them means changing two systems at once.

RL’s network data on the server itself was thin at that point. 213[.]145[.]86[.]112 is a bare metal server at Latitude.sh (AS396356) in New York. It carried no RL classification, and was flagged by just one third-party source, CyRadar, before Microsoft’s report. It entered RL’s telemetry on July 10 at 02:00 UTC, when RL first retrieved a file from it. The next three pivots supplied the connections that gave the server its meaning.

2. From the beacon labels to five more stagers

RL researchers wrote a YARA rule on the beacon path and the two stage labels, required two PowerShell execution primitives so that indicator lists and blog posts would not match, and ran it as a retro-hunt in Spectra Analyze. It returned seven files, all PowerShell, all classified malicious, none classified goodware, suspicious or unknown. One is the Anthropic-listed stager. Five are catalogued in IOC section C as the rebuilt stagers; the earliest reached RL on July 9, a day before the stager Anthropic listed. The seventh is a close, fuzzy-hash match to one of the five and is listed pending a capability comparison.

Figure 4. Retrohunt result in Spectra Analyze for RL’s beacon-label YARA rule. Note the malicious count and the empty goodware, suspicious and unknown columns.

Figure 5. Ruleset details for the same rule. Note seven matched samples, all PowerShell, including the Anthropic-listed stager and the seventh match listed last in IOC section C.

Not every one of those five is tied to the cluster equally, and the next pivot is what separates them.

3. From the server to the files it served

File provenance in Spectra Intelligence records where RL retrieved a file from. A uri-source query for anything retrieved from the staging server returned four files. Two are stagers from the retro-hunt: one served at /s on July 15, the other at /cdn/chunks/vendor-9f3a1c[.]min[.]js on July 20, disguised as a JavaScript bundle. The other two are copies of polyfill-7e2b.min.js, a 34 KB JavaScript library served from the same /cdn/chunks/ path, which RL classifies as goodware. Microsoft lists that polyfill path as a ChocoShell “tooling fetch.” Whether the operator served a genuine library as cover or as a dependency, the path is part of the stager’s traffic, and the URL for it is classified malicious in RL’s network data.

Those two served stagers, plus the two lure files in the next section, are the files RL ties to the cluster with high confidence, because they were hosted on or point to infrastructure both Anthropic and Microsoft attribute to it. The other three retro-hunt stagers share the code and the beacon labels but have no observed network link, so our confidence that they come from the same operator is moderate; a second party reusing the stager template cannot be excluded. No file RL found should be called “Midnight Blizzard malware” on RL’s authority.

4. From the server to the lure files

A uri-static query for any file that embeds a URL on the staging server returned two Windows Internet Shortcut (.url) files and four indicator documents. Each shortcut is 60 bytes. Each holds nothing but a link to a stager path on the server with its own session token: one opens /s?r=7ed4bb1d, the other opens the fake JavaScript bundle path with ref=95766022. The paths match the ones RL saw serving stagers in July, and RL first saw the shortcuts on July 14 and July 17, between the two retrievals. We assess these are the user-facing steps of the infection chain (Figure 1 red panel). The shortcuts also expose a gap, and it is RL’s own. They contain no code, so none of 37 antivirus engines flags either one, and RL’s consensus-based cloud verdict on both was still goodware on September 28. In other words: their malicious intent is based on where they point, not what they contain. RL’s extensive relationship data supplied what the verdict could not.

Figure 6. Spectra Intelligence summary for one delivery shortcut, a file that exists only to launch the stager. None of the 37 community detections of the file identified the file as malicious.

5. From domains to servers, and from the backdoor to a new address

Anthropic lists the cluster’s domains and servers in separate sections, with no relationships between them. Spectra Intelligence resolution data supplies two: ms365-live[.]com resolves to 104[.]145[.]210[.]184, the device-code phishing server, and owa-ms365[.]com resolves to 31[.]57[.]243[.]154, the phishing host. Microsoft’s report lists the same two domains and the same two addresses, also without the resolution between them.

The backdoor produced one more lead. RL relationship data lists the Anthropic-published Go backdoor under “Files Communicating with IP” for 192[.]142[.]52[.]31, a Madrid address at Ultahost, the provider behind the cluster’s phishing VPS as well. The address is in neither report and carries no RL classification. Three more files reference it: a 12.9 MB text file RL classifies as Text.Hyperlink.Homoglyph and two documents from August 22 that also list the stager host. We assess with moderate confidence that the address  is infrastructure the backdoor uses, and we list it as a hunting lead to validate before any blocking.

One pivot is worth reporting because it failed. A plain string search for the staging server address returned 82 files over a year, almost all indicator documents published after August 4, along with an Allaple worm doing random scanning. None of the retro-hunt stagers appeared, because they do not embed the address as a literal string. Every pivot that worked followed a relationship between artifacts; the string search looked for an artifact itself.

Similarity: Two code variants, one behavior

The five rebuilt stagers carry five different hashes. In RL’s analysis they carry one identical 35-item capability profile, the same MITRE ATT&CK tactic profile (Defense Evasion 6, Discovery 4, Execution 4), and the same three classification components: a Spectra Core machine-learning verdict, a Spectra Core RICC match for PowerSploit and Empire collection code, and threat reputation.

Fuzzy hashing splits them in two. By ssdeep, the Anthropic-listed stager groups with 154d8cfd9e304b66…, 1b97e0df9600335b…, 7acb7082d3785487… and 99f2eac2f00451a9… at similarity scores of 88 to 100. 04b64591837c5c26… matches none of them and pairs only with the seventh YARA match, 6e5c658261f72fda…, at 82. The operator made at least one code change large enough to break fuzzy-hash similarity, and the change did not touch the window hiding, the Base64 execution, the browser-history collection or the beacon labels. Spectra Analyze limits ssdeep searches to the last month regardless of the time filter, so those match sets are a floor, and TLSH was too loose on text files of this size to add anything.

The build-time signals that ought to connect related files did the opposite here, and the reason is worth one paragraph. The Go backdoor’s import hash matches 12.0K goodware-classified and 6.9K malicious-classified files in RL telemetry over the past year, because Go programs built with the same toolchain import the same functions regardless of purpose. Its install filename, svchost32.exe, appears in 14 unrelated malicious files over the same window. RHA, RL’s functional-similarity search, returned about 19,500 files for the backdoor across dozens of families and zero for the stager. A rebuild changes compiler and naming fingerprints at no cost to the operator.

Timeline

Figure 7. Spectra Analyze Timeline for the stager (left) and the Go backdoor (right), captured September 28, 2026. Note the July first-seen entries at the top and the first MALICIOUS classifications on August 1.

Two things about that table need saying plainly. 

• First, RL’s August 1 verdict landed the day after Microsoft’s publication, and the classification reason on both files is threat reputation, so RL’s data does not show an independent verdict ahead of Microsoft. The first-seen dates do show that both files, five more stagers, both lure files and the staging server were in RL telemetry three to four weeks before anyone published. 
• Second, the five stagers arrived through external feeds between July 9 and August 3, a 25-day window that is consistent with Anthropic’s account of a rebuild loop, though RL’s data cannot show what produced them.

Infrastructure: What the network indicators show beyond a score

Third-party reputation on this infrastructure was thin and late. Of the 14 servers Anthropic lists, 13 were flagged by 0 to 5 of roughly 49 sources when RL checked them on September 21 and 23, and the staging server was at 6 of 50 by September 24, with only CyRadar flagging it before Microsoft’s report. Of 61 cluster domains RL classifies as malicious, the median is flagged by 2 of about 47 sources. That is the wrong place to look for a verdict on this cluster, and the indicators carry better signals.

Impersonation

Every domain in the set that RL could characterize is a lookalike. Four impersonate Microsoft 365 sign-in and Outlook Web Access (ms365-live[.]com, owa-ms365[.]com, ms365-device[.]com, m365-owa[.]com); Microsoft confirms the first two as device-code redirect hosts and the second two as adversary-in-the-middle infrastructure. One impersonates WhatsApp Web pairing (wa-meeting[.]com). Two impersonate the targets’ own institutions: chathamhouse[.]eu for the London think tank and chamber-ua[.]org for a Ukrainian chamber of commerce. The two sender addresses impersonate a Russian expatriate organization and an embassy protocol office. The naming alone matches the victim profile Anthropic describes.

Hosting 

The infrastructure sits on rented capacity across five providers in four countries: 

• Latitude.sh carries two of it: the stager’s bare metal in New York (AS396356) and the phishing host 31[.]57[.]243[.]154 that serves owa-ms365[.]com (AS262287, registered to Latitude.sh LTDA, the Brazilian company that was Maxihost until 2022). 
• Ultahost (US and Madrid) hosts the device-code phishing VPS and the new lead. 
• Tornado Datacenter (UK) hosts the primary C2, Cogent the phishing console’s notifier, and RouterHosting hosts the server holding exfiltrated browser data as well as, by URL analysis, chamber-ua[.]org, chathamhouse[.]eu and Microsoft’s 104[.]194[.]159[.]150. 

The lookalike domains that are still up front themselves with Cloudflare. The stager beacons to a raw IP on bare metal with no domain in front of it, which is commodity tradecraft and a detectable one: an HTTPS request to a raw IP for a tracking-pixel path is the pattern the Sigma rule in IOC section H keys on.

Overlap with other reporting 

Microsoft’s July 31 indicator list and Anthropic’s September 10 appendix share the four M365 domains, three servers and both hashes, and Microsoft’s list adds three servers that Anthropic’s does not: 107[.]189[.]26[.]194, which Microsoft labels a second ChocoShell C2 and a DNS resolver, 104[.]194[.]159[.]150 and 38[.]146[.]28[.]132. RL has not yet enriched those three; they are queued with the URL scans in editor note 9.

Figure 8. Third-party reputation for the stager server in Spectra Analyze on September 24, 2026. Note “No Classification” at the top and the detection times: one source two months ago, five within the last two weeks.

Still live on October 5 

RL researchers ran Spectra Analyze URL analysis on the staging-server paths and the cluster’s domains on October 5, 2026, eight weeks after Microsoft’s report and almost four after Anthropic’s. The staging server answered HTTP 200 on /s, on the shortcut target /s?r=7ed4bb1d and on the fake JavaScript bundle path, and each of those requests downloaded one file RL classifies malicious; the polyfill path answered 200 with a goodware file.

RL classifies every one of those URLs as malicious (Web.Hyperlink.Blacklisted), while just 2 or 3 of 50 third party reputation sources does so. 

The phishing domains are in the same state: ms365-live[.]com (created 2026-05-14, now behind Cloudflare), wa-meeting[.]com (Cloudflare) and chamber-ua[.]org (RouterHosting, registered 2026-02-16) all answered 200, chathamhouse[.]eu answered 200 and is classified suspicious (Web.Hyperlink.Spam), and owa-ms365[.]com returned 403 from the Latitude.sh phishing host. Ten of the 21 URLs had finished analysis at capture time; the rest are listed as pending in IOC section D.

Figure 9. Spectra Analyze URL analysis on October 5, 2026 for the stager download path (top), the Outlook Web Access lookalike (middle) and the Ukrainian chamber lookalike (bottom). Note the HTTP 200 on the stager path with one malicious downloaded file, the Latitude.sh LTDA serving address behind the OWA lookalike, and the third-party-reputation classification reason on all three. 

Observed infection chain

Internet Shortcut (.url, 60 bytes)                  [user opens; assessed from the shortcut contents]
└── HTTPS GET hxxps://213[.]145[.]86[.]112/s?r=<token>
    or        hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=<token>&stub=1
    └── PowerShell stager (hidden window, execution-policy change, Base64 decode and execute)
        ├── fetches /cdn/chunks/polyfill-7e2b[.]min[.]js (goodware library; “tooling fetch” per Microsoft)
        ├── PowerSploit/Empire browser-history collection, WMI shadow-copy enumeration
        ├── HTTPS beacon /t/pixel[.]gif?m=stage2_entry | stage2_ctx_<flags> | collecting | key_abe_<…>
        └── HTTPS POST /t/event (exfiltration, per Microsoft)

Go backdoor, svchost32.exe                           [delivery path not observed by RL]
├── copies itself to %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe
├── HKCU Run value and Schedule.Service COM object (Microsoft: also a “Cloud Sync Service” Windows service)
├── suspended-process injection
├── Edge, Chrome, Firefox profile and Microsoft Teams cache access; keylogger and raw-input device
└── network contact with 192[.]142[.]52[.]31 (RL relationship data; not in either public report)

RL observed the shortcut contents, the served stagers, the beacons and the backdoor’s host behavior directly. RL did not observe how the Go backdoor reaches a host, and did not observe a link between the stager and the backdoor. As it turns out, the two are connected through the two vendors’ listing of both for the same cluster. Microsoft’s chain for CaptiveCrunch starts further upstream, at compromised hotel- and venue captive portals that redirect travelers to the phishing domains and to ClickFix pages that deliver the malware. RL’s telemetry does not reach that layer. However, nothing in it contradicts what RL reported.

Detection

The YARA rule that ran the retro-hunt and a second rule for the Go backdoor are in IOC section G, with the Sigma rules for the backdoor’s install path and the beacon pattern in section H. 

The PowerShell rule keys on the beacon path and the stage labels because the operator chose them and because they have to match server-side code; it survived two code variants that fuzzy hashing cannot connect. Validate both rules against a goodware corpus before deploying them, and note that the extra beacon labels RL’s sandbox observed (collecting, key_abe_) are not in the published rule.

Summary

To sum up, the following are the main discoveries from RL’s retro-hunt following the release of Anthropic’s report: 

• Both seed files, five more stagers, two lure files and the server behind them were in RL telemetry three to four weeks before Microsoft published and two months before Anthropic did. 
• The expansion came from relationships, not from hashes. Content extraction gave the server, a YARA rule on operator-chosen strings gave five stagers, and file provenance, a URL pivot and resolution data gave the rest. The one plain string search failed.
• Five hashes, two code variants, one behavior profile. The rebuild changed what a hash, an import hash and a fuzzy hash see. It did not change the capability profile or the beacon labels.
• Reputation scores were the weakest signal on this infrastructure. Impersonation, hosting pattern, file relationships, resolution data and a live URL analysis each said more than the 0-to-6-of-50 third-party counts did, and RL’s own consensus verdict on the two lure files is still goodware.
• The staging server was still serving the stager on October 5. Eight weeks after the first public report, /s and the shortcut targets answered HTTP 200 with a malicious file. 

Recommendations

In light of the observations above, here are some recommended actions your organization can take to respond to the finding of Anthropic’s Midnight Blizzard report, as well as similar reports issued by other vendors and suppliers. 

• Query every vendor report’s indicators against historical telemetry the day it lands; the useful question is “was this here, and when?”
• Block the server and the domains in IOC section E; do not assume disclosure took them down.
• Close the access path. Review Microsoft Entra ID sign-ins for device-code authentication and block the device-code flow with Conditional Access where the business allows it. Everything in this post is downstream of that access.

Sources

• Anthropic, Threat Intelligence Report, September 2026, September 10, 2026. Source of the GTG-20006 case, the two seed hashes and the 209-row indicator appendix.
• Microsoft Threat Intelligence, CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft, July 31, 2026. Names CornFlake and ChocoShell, attributes Storm-2945 to Midnight Blizzard, lists the shared indicators.
• Volexity, Multiple Russian threat actors targeting Microsoft device code authentication, February 13, 2025. Earlier device-code phishing by APT29-overlapping clusters.
• Microsoft Threat Intelligence, Storm-2372 conducts device code phishing campaign, February 13, 2025.
• MITRE ATT&CK, G0016 APT29.
• RL product references: Spectra Intelligence, Spectra Analyze [CONFIRM URL].

Indicators and research data

All indicators are TLP:CLEAR. Items marked RL were identified by RL and are not in Anthropic’s appendix; items marked Microsoft come from the CaptiveCrunch report and were not independently observed by RL. The full Anthropic indicator set is in the source report.

A. Seed sample detail

The beacon’s ctx_admin_la_true value may report local administrator context; we assess that reading with low confidence.

B. Research pivots

Each row is one query RL researchers ran, in the order the body describes them. Ambiguous or failed results are kept.

8 | Beacon status labels | Stager sandbox network references (38 URLs) | Beyond stage2_entry and stage2_ctx_: m=collecting…, m=key_abe_s…, and a /WZ path, all on the staging server. Not in the published YARA rule |
9 | URL analysis | Spectra Analyze Submit, URL Analysis, plus the uri: search “View Network Page” for each URL | Pending (editor note 9): the eight staging-server URLs, eight phishing domains, 192[.]142[.]52[.]31 and the three Microsoft-only servers |

C. Related files and confidence tiers

Rebuilt stagers (RL)

All five are PowerShell scripts of about 57 to 58 KB with an identical 35-item capability profile, and all arrived together in one external feed batch on 2026-08-21. Third-party family names on them (Boxter, Infostealer.Heuristic) are bulk heuristics with more than 20,000 hits in 2026 and carry no attribution weight. The seventh match has the same type and size and is a close ssdeep match to 04b64591837c5c26…; it is listed here pending a capability-profile comparison.

Delivery shortcuts (RL)

Both shortcuts are malicious. RL’s cloud verdict on them was still goodware on the 2026-09-28 recapture (threat reputation, trust factor 5), based on antivirus consensus alone.

Attribution tiers

D. Infrastructure and domain enrichment

The remaining eight listed IPs score 0 to 5 of 49 to 50 sources, none malware-associated; three first appeared in RL telemetry on 2026-09-21 and 09-22. Microsoft’s CaptiveCrunch list adds 107[.]189[.]26[.]194 (ChocoShell C2 and DNS resolver), 104[.]194[.]159[.]150 and 38[.]146[.]28[.]132 (DNS resolver), which RL has not yet enriched.

The delivery shortcuts show the same gap from the file side. They contain no code, so none of 37 antivirus engines flag them, RL’s cloud verdict on them is goodware, and URL reputation had no record of their targets until RL queried them. Their malice is entirely in where they point.

The domains followed the pattern over a longer period. Of the 61 domains in Anthropic’s appendix that RL now classifies as malicious, 48 were already in RL telemetry before publication and 43 more than a month before. The median domain is still flagged by only 2 of about 47 reputation sources. The capabilities in the files, and the relationships linking those files to domains and servers, supplied the context that reputation scores did not.

A first-seen date records when RL observed a domain and says nothing about its classification at that time.

URL analysis, 2026-10-05 (Spectra Analyze, cloud crawl, depth 1)

The Latitude.sh and RouterHosting entries put Anthropic’s phishing host, the staging server, two lure domains and one Microsoft-only server on two providers. Downloaded-file counts are RL’s classification of what the crawl retrieved; “n/a” means the third-party count was not read from the capture.

E. Network indicators

All IOCs and indicators in this blog post can be found in our GitHub repository [LINK]. The following is a subset for reference.

Hunting lead (validate before blocking): 192[.]142[.]52[.]31 (Ultahost, Madrid, RL first seen 2026-09-06, 2 of 50 sources, no RL classification). RL relationship data lists the Go backdoor under “Files Communicating with IP” for it, and three further files reference it. It is in neither public report. We assess with moderate confidence that it is infrastructure the backdoor uses.

F. MITRE ATT&CK mapping

Mapped to ATT&CK Enterprise [CONFIRM CURRENT VERSION]. Techniques marked report come from Anthropic’s or Microsoft’s description of the cluster.

An ATT&CK Navigator layer is available on request.

G. YARA rules

Hunting-grade rules. Strings come from artifacts RL extracted from the samples, not full disassembly. Validate against the samples and a goodware corpus before production use.

import "pe"

rule RL_MidnightBlizzard_GTG20006_PowerShell_PixelBeacon_2026 {
    meta:
        description = "Detects PowerShell stager beaconing with stage labels in a pixel.gif query string, as seen in Midnight Blizzard-linked GTG-20006 sample 123.ps1"
        author      = "Igor Lasic, ReversingLabs"
        date        = "2026-09-25"
        reference   = "https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure"
        hash        = "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c"
        score       = 70
    strings:
        // Rationale: beacon path and stage labels are operator-chosen and survived across five rebuilt stagers
        $p1 = "/t/pixel.gif" ascii wide nocase
        $s1 = "stage2_entry" ascii wide nocase
        $s2 = "stage2_ctx_" ascii wide nocase
        // Rationale: require real PowerShell execution primitives to keep IOC reports and blog text out
        $ps1 = "FromBase64String" ascii wide nocase
        $ps2 = "Invoke-Expression" ascii wide nocase
        $ps3 = "IEX" ascii wide
        $ps4 = "Start-Job" ascii wide nocase
        // Exclusion: this rule's own text and published rule sets
        $self = "rule RL_MidnightBlizzard_GTG20006" ascii
    condition:
        filesize < 200KB and
        $p1 and 1 of ($s*) and 2 of ($ps*) and
        not $self
}

rule RL_MidnightBlizzard_GTG20006_Go_Svchost32_Backdoor_2026 {
    meta:
        description = "Detects Go x64 backdoor using kardianos/service that installs as svchost32.exe under LocalAppData\\Microsoft, as seen in Midnight Blizzard-linked GTG-20006"
        author      = "Igor Lasic, ReversingLabs"
        date        = "2026-09-25"
        reference   = "https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure"
        hash        = "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593"
        score       = 60
    strings:
        // Rationale: Go build ID plus the three modules identified by static decomposition
        $go = "Go build ID:" ascii
        $m1 = "github.com/kardianos/service" ascii
        $m2 = "github.com/fsnotify/fsnotify" ascii
        $m3 = "github.com/go-ole/go-ole" ascii
        // Rationale: install name and marker-file names observed in the sandbox; confirm they are static strings
        $n1 = "svchost32" ascii wide
        $n2 = ".svchost32mid" ascii wide
        $n3 = ".svchost32ul" ascii wide
    condition:
        pe.is_pe and pe.is_64bit() and
        $go and all of ($m*) and
        ($n1 and 1 of ($n2, $n3))
}

The PowerShell rule keys on the beacon path and stage labels because the operator chose them and they persisted across all five rebuilt stagers; its retro-hunt returned only malicious files. Security content that quotes the URL is the main false-positive risk, so the rule also requires two PowerShell execution primitives, caps file size and excludes its own text. The Go rule is weaker: the module combination is common in legitimate Go service agents, so the svchost32 strings do the discriminating work. Confirm they exist as static strings before relying on the rule, and test it against internal Go tooling and IT management agents.

H. Sigma rules

title: Executable Launched From Fake svchost32 Folder Under LocalAppData Microsoft
id: 7c1d4e2a-5b8f-4a3e-9d61-2f0b8c7e4a19
status: experimental
description: Detects execution of svchost32.exe from %LOCALAPPDATA%\Microsoft\svchost32\, the install path of a Midnight Blizzard-linked (GTG-20006) Go backdoor analyzed by RL
references:
    - https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure
    - https://www.anthropic.com/threat-intelligence-report-september-2026
author: Igor Lasic, ReversingLabs
date: 2026-09-25
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1547.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\AppData\Local\Microsoft\svchost32\svchost32.exe'
    condition: selection
falsepositives:
    - None known; svchost32.exe is not a Windows component
level: high
title: PowerShell Script Block With Raw-IP Pixel Beacon And Stage Labels
id: 3e9a7f10-8c2d-4b6e-a5f1-6d0c9b2e7a44
status: experimental
description: Detects PowerShell script block content matching the Midnight Blizzard-linked (GTG-20006) stager pattern of an HTTPS request to a raw IP pixel.gif path with stage labels
references:
    - https://www.reversinglabs.com/blog/midnight-blizzard-malware-rl-telemetry-before-disclosure
author: Igor Lasic, ReversingLabs
date: 2026-09-25
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command-and-control
    - attack.t1071.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requires Script Block Logging'
detection:
    selection_beacon:
        ScriptBlockText|re: 'https?://\d{1,3}(\.\d{1,3}){3}/t/pixel\.gif'
    selection_stage:
        ScriptBlockText|contains:
            - 'stage2_entry'
            - 'stage2_ctx_'
    condition: selection_beacon and selection_stage
falsepositives:
    - Analyst tooling or scripts that embed published IOC strings
level: high

I. Spectra Intelligence hunting queries

sha256:918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
uri-source:"https://213.145.86.112/*"
uri-static:"https://213.145.86.112/*"
uri-static:"*stage2_entry*"
ipv4:213.145.86.112 classification:malicious
filename:svchost32.exe classification:malicious firstseen:[2026-06-01T00:00:00Z TO *]

Explore RL’s Spectra suite: Spectra Assure for software supply chain security, Spectra Detect for scalable file analysis, Spectra Analyze for malware analysis and threat hunting, and Spectra Intelligence for reputation data and intelligence.