Claude AI aids Midnight Blizzard in evading detection across European and Ukrainian networks

Government employees and defense contractors in Ukraine and Europe faced renewed espionage attempts after hackers used generative AI to rebuild their malware tools. Operators linked to the Midnight Blizzard group utilized Anthropic’s Claude AI to modify malicious code after initial detection, helping them keep espionage operations running against these targets without triggering immediate alerts from security systems.

Anthropic tracked this specific activity under the identifier GTG-20006, noting that the targeting methods and operational patterns align with public reports on Midnight Blizzard. The group focused its efforts on more than 20 entities, including government agencies, diplomatic missions, think tanks, and defense organizations. This widespread targeting indicates a sustained campaign aimed at continuing espionage activities against high-value institutions rather than opportunistic attacks.

Technical details of the campaign

Researchers at ReversingLabs identified two primary malicious tools: ChocoShell, a PowerShell stager, and CornFlake, a Windows backdoor written in Go. Microsoft previously named these tools in its CaptiveCrunch report and linked the operation to Storm-2945, an assessed subgroup of Midnight Blizzard. ReversingLabs first observed CornFlake on July 6 and ChocoShell on July 10, though formal classification as malicious occurred on August 1 following Microsoft’s disclosure.

The malware exhibits specific technical behaviors designed to evade detection and gather data. ChocoShell hides its execution window, alters PowerShell execution policies, and runs Base64-encoded commands. It leverages public code from PowerSploit and Empire frameworks to collect browser history, check Windows shadow copies via WMI, and execute background jobs. These actions are consistent with the technical capabilities described in the research report.

Attribution and investigation challenges

Anthropic reported that the operator used Claude AI to find, change, and redeploy detected implants, extending automation beyond code writing to phishing systems and data collection. ReversingLabs found five additional stager builds released between July 9 and August 3, suggesting a rapid rebuild cycle. However, the researchers noted that their file analysis alone does not independently prove the actor’s identity, relying instead on behavioral similarities and server links.

Changing a file’s code and hash did not erase the shared behaviors and server connections that helped investigators trace the campaign. By expanding two published file hashes, the research team mapped a broader campaign involving a staging server, five additional PowerShell builds, two shortcut lures, and links between phishing domains and servers. This demonstrates that superficial code changes are insufficient for threat actors to hide their operational footprint.

Our take on the response

The finding that AI-assisted code modification did not remove behavioral fingerprints suggests that static hash-based detection remains vulnerable to automated rebuilds. Security teams must prioritize behavioral analysis and network traffic monitoring over simple file signature matching. The integration of AI into the malware development lifecycle accelerates the iteration cycle, requiring defenders to adapt their response strategies to catch functional similarities rather than exact code matches.

For customers and users

Organizations targeted by this campaign should verify whether their systems exhibited signs of unauthorized PowerShell execution or hidden background jobs. Employees should report any unexpected shortcut icons or unusual email requests for credentials immediately. Teams usually monitor network traffic for connections to known staging servers or suspicious domains linked to phishing attempts. Check whether endpoint detection tools are configured to flag behavioral anomalies rather than relying solely on file hashes. Be alert to follow-up scams that reference this breach to trick users into revealing further information or installing additional malware.

Background: Backdoors

Use this checklist to verify your system integrity. Focus on disabling unused network services, verifying boot integrity, and monitoring for unexpected administrative access. These steps reduce the attack surface where attackers install hidden entry points. Regular audits ensure no unauthorized software remains active on your network.

Read the full guide: Backdoors Prevention Checklist for Securing Systems

What to do and how to stay safe: Midnight Blizzard

• Review PowerShell execution logs for scripts that hide windows or alter execution policies unexpectedly.
• Monitor network traffic for connections to newly registered domains or servers associated with phishing campaigns.
• Ensure endpoint detection solutions are tuned to identify behavioral patterns like background job creation and browser history access.
• Train staff to recognize phishing emails that mimic legitimate communications but contain malicious shortcut lures.

Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific malware was rebuilt using AI in this campaign?

The campaign involved ChocoShell, a PowerShell stager, and CornFlake, a Windows backdoor written in Go.

Which organizations were targeted by these hackers?

More than 20 government, diplomatic, think tank, and defense organizations in Ukraine and Europe were targeted.

Did the AI rebuild erase all traces of the malware?

No, changing the code and hash did not erase shared behaviors or server links that helped investigators trace the group.