{"id":26312,"date":"2026-10-15T05:00:11","date_gmt":"2026-10-15T13:00:11","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/15\/how-rl-mapped-a-midnight-blizzard-linked-campaign-from-two-hashes\/"},"modified":"2026-10-15T05:00:11","modified_gmt":"2026-10-15T13:00:11","slug":"how-rl-mapped-a-midnight-blizzard-linked-campaign-from-two-hashes","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/10\/15\/how-rl-mapped-a-midnight-blizzard-linked-campaign-from-two-hashes\/","title":{"rendered":"How RL mapped a Midnight Blizzard-linked campaign from two hashes"},"content":{"rendered":"
\n
\n

ReversingLabs (RL) researchers recently identified and classified the malware that Anthropic disclosed in its September 2026 report on how the Russian-based threat group Midnight Blizzard was leveraging Anthropic\u2019s Claude AI to rebuild- and redeploy flagged software implants, making them harder for victims to detect.<\/p>\n

As noted in that report<\/a>, RL had detected and tracked the malware samples for weeks before the Anthropic report was published \u2014 showing why behavioral intelligence and historical telemetry matter in the AI age. Since then we\u2019ve been asked to explain more about the process we used to link Anthropic\u2019s research to a much larger malicious campaign.\u00a0<\/p>\n

In this post, RL researchers walk through the two samples and the five pivots that turned them into a campaign map, then through the similarity analysis that ties the stagers together and a dated timeline. Every hash, URL, rule and query is in the indicators section at the end.<\/p>\n

[ See report: <\/strong>What RL Found Before Anthropic\u2019s Midnight Blizzard Report<\/strong><\/a> ]<\/strong><\/p>\n

File hashes with a lot to say<\/strong><\/h2>\n

To start its research, RL took the two malware hashes Anthropic published in its September 2026 case on GTG-20006, an espionage operator Anthropic links to Midnight Blizzard, and worked outward from them through RL telemetry.\u00a0<\/p>\n

Specifically, the two files led us to the operator\u2019s staging server and to five more builds of the same server. They also led to a host of other revealing threat indicators. That included two lure files built to launch it; two files the server had served; and two resolution links between the cluster\u2019s phishing domains and its servers. None of those indicators appear in Anthropic\u2019s indicator appendix, and most of it is absent from Microsoft\u2019s CaptiveCrunch report, which covers the same operation. But for defenders, such intelligence is critical.\u00a0<\/p>\n

As we noted in our first report on Midnight Blizzard, both of the malware \u201cseed\u201d files Anthropic provided hashes for were already in RL telemetry before either report. RL first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10. Microsoft published on July 31 and named the files CornFlake and ChocoShell; RL\u2019s platform classified both as malicious on August 1; Anthropic published on September 10. Anthropic\u2019s finding is that the operator used Claude to rebuild implants once security products flagged them, and RL\u2019s data is consistent with that: five builds of the stager, with five different hashes, reached RL in 25 days.\u00a0<\/p>\n

The builds changed. What each build had to do \u2013 and the server it had to talk to\u2013 did not, and that is what made the campaign traceable.<\/p>\n

\n