ReversingLabs started from two Anthropic-published hashes and traced a Midnight Blizzard-linked campaign to new servers, lures and domains
ReversingLabs says it expanded the two file hashes in Anthropic's Midnight Blizzard report into a campaign map in five pivots. RL says Anthropic's appendix does not list the servers, lures and domain links it found.
The Watch · Security desk
Timeline: RL first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10. Microsoft published on July 31, naming the files CornFlake and ChocoShell. RL's platform classified both files as malicious on August 1. Anthropic published its report on September 10.
| Date | Event | Claim |
|---|---|---|
| July 6, 2026 | RL first observes the Go backdoor | 16 |
| July 10, 2026 | RL first observes the PowerShell stager | 16 |
| July 31, 2026 | Microsoft publishes, naming the files CornFlake and ChocoShell | 17 |
| August 1, 2026 | RL's platform classifies both files as malicious | 18 |
| September 10, 2026 | Anthropic publishes its report | 19 |
What happened
- Anthropic's report says the cluster it tracks as GTG-20006 went after more than 20 organizations in government, diplomacy, think tanks and the defense industry, most of them in Ukraine and Europe.
- The Go backdoor first showed up in RL's data on July 6, 2026, and the PowerShell stager on July 10, before either Microsoft or Anthropic published.
- The pivots returned the staging server, five more builds of it, two lure files, two files the server had served, and two links between phishing domains and servers.
Why it matters
- exposure Defenders who loaded only the vendor lists are blind to the staging server and its other builds. Microsoft's report leaves out most of RL's finds as well.
- decision A file-hash rule covers one build, and RL saw a new hash about every five days. Detection has to key on the server and the beacon path, which stayed fixed.
- contradiction RL says it tracked the samples for weeks before Anthropic published, but its malicious classification is dated August 1, the day after Microsoft's report.
RL says it traced the campaign through what stayed the same from build to build: what each build had to do, and the server it had to talk to [3]. File hashes were a poor key. Five stager builds arrived with five different hashes in 25 days [1], an average of one new hash every five days [12]. Anthropic's appendix lists 209 indicators, but only two are file hashes [7].
Microsoft's CaptiveCrunch report does not include most of what RL found either [15]. The two vendors overlap on the seeds: both name the same two hashes and the same beacon path, along with four domains built to imitate Microsoft 365 and three servers that appear in both reports [9]. RL says every hash, URL, rule and query from its work is in an indicators section at the end of its post [20].
Microsoft published on July 31 and named the two files CornFlake and ChocoShell [17]. RL's platform classified both as malicious on August 1 [18], and Anthropic published on September 10 [19]. Counted from RL's first sight of the Go backdoor, those are 26 days to a verdict [22] and 66 days to Anthropic's report [23].
Attribution rests on the two vendors. Anthropic describes GTG-20006 as a Russian-speaking operator, with attribution "consistent with public reporting linking the actor to Midnight Blizzard" [4]. Microsoft, under the name CaptiveCrunch, assesses that Storm-2945 is "an operational sub-cluster of Midnight Blizzard" [8]. Midnight Blizzard is also tracked as APT29, Cozy Bear and NOBELIUM [11].
On the AI claim, confidence varies by source. According to Anthropic, the operator "used Claude to systematically identify, modify and redeploy the detected artifacts" when its implants were flagged [6]. Microsoft's wording was softer. It said the ChocoShell script "was authored with full developer comments" in a style that, in Microsoft's assessment, suggests the author might have used AI-assisted code generation [10]. RL says its data is consistent with Anthropic's finding [2].
In our view, five hashes in 25 days fits that account but does not show which tool made the changes.
What to watch
- Whether Anthropic or Microsoft adds RL's staging-server, lure and domain-resolution indicators to their published lists.
- Any stager build after September 10 with a new hash, which would extend the five-in-25-days pattern RL recorded.
- A second source for the Claude rebuild claim, since Microsoft's published wording covers only code style.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Five builds of the stager, with five different hashes, reached RL in 25 days.
- [2]
RL says its data is consistent with Anthropic's finding that the operator used Claude to rebuild implants once security products flagged them.
- [3]
The builds changed, but what each build had to do and the server it had to talk to did not, and that is what made the campaign traceable.
- [4]
Anthropic describes GTG-20006 as a Russian-speaking operator whose attribution is "consistent with public reporting linking the actor to Midnight Blizzard."
- [5]
According to Anthropic, the cluster targeted more than 20 government, diplomatic, think-tank and defense-industrial organizations, mostly in Ukraine and Europe, and stole Microsoft 365 access through device-code phishing run from a framework Anthropic calls "Embassy Kit."
- [6]
According to Anthropic, the operator "used Claude to systematically identify, modify and redeploy the detected artifacts" when its implants were flagged.
- [7]
Anthropic's appendix lists 209 indicators, among them 14 IP addresses, two email addresses and two file hashes.
- [8]
Microsoft published on the same infrastructure under the name CaptiveCrunch, attributing it to Storm-2945, which Microsoft assesses is "an operational sub-cluster of Midnight Blizzard."
- [9]
Microsoft's indicator list overlaps Anthropic's: the same two hashes, the same four Microsoft 365 lookalike domains, three of the same servers and the beacon path.
- [10]
Microsoft noted that the ChocoShell script "was authored with full developer comments" in a style that "suggest[s] the author might have leveraged AI-assisted code generation."
- [11]
Midnight Blizzard is also tracked as APT29, Cozy Bear and NOBELIUM.
- [12]
Five stager builds in 25 days averages one new build, and one new hash, every five days.
- [13]
RL took the two malware hashes Anthropic published in its September 2026 case on GTG-20006, an espionage operator Anthropic links to Midnight Blizzard, and worked outward from them through RL telemetry.
- [14]
The two files led RL to the operator's staging server and five more builds of the same server, plus two lure files built to launch it, two files the server had served, and two resolution links between the cluster's phishing domains and its servers.
- [15]
None of those indicators appear in Anthropic's indicator appendix, and most are absent from Microsoft's CaptiveCrunch report, which covers the same operation.
- [16]
Both seed files were already in RL telemetry before either report. RL first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10.
- [17]
Microsoft published on July 31 and named the files CornFlake (the Go backdoor) and ChocoShell (the PowerShell file).
- [18]
RL's platform classified both files as malicious on August 1.
- [19]
Anthropic published its report on September 10.
- [20]
Every hash, URL, rule and query from RL's work is in the indicators section at the end of RL's post.
- [21]
RL says it detected and tracked the malware samples for weeks before the Anthropic report was published.
- [22]
RL's malicious classification came 26 days after it first observed the Go backdoor.
- [23]
Anthropic published 66 days after RL first observed the Go backdoor.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- reversinglabs.comHow RL mapped a Midnight Blizzard-linked campaign from two hashes
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Threat Intelligence and Incident ResponseFollow
- Nation-state espionageFollow
- AI misuse by threat actorsFollow