Detect AI-Rebuilt Malware by Tracking Shared Behaviors and Server Links
Midnight Blizzard actors used Claude AI to regenerate detected implants, but shared infrastructure links allowed researchers to map the campaign across European targets.
Key points
- Attackers used Anthropic’s Claude AI to rebuild malware after initial detection by security tools.
- The campaign targeted over 20 government, diplomatic, and defense organizations in Ukraine and Europe.
- File hash changes did not erase shared behaviors or server connections that linked the samples.
Security teams can detect malware rebuilt by artificial intelligence by focusing on persistent infrastructure links rather than file hashes alone. Operators linked to the Midnight Blizzard threat group used Anthropic’s Claude AI to regenerate malicious code after security tools flagged original implants. This activity supported ongoing espionage operations against Ukrainian and European entities, according to Cyber Security News.
The risk
The primary risk involves adversaries using AI to automate the modification and redeployment of detected implants. Anthropic tracks this activity under identifier GTG-20006 and notes that the targeting methods align with public reporting on Midnight Blizzard. The operator used Claude not only for writing code but also for managing phishing systems, updating malware, and collecting stolen data. This automation allows attackers to maintain operational continuity even when specific file variants are identified and blocked by defensive tools.
Who is exposed
The operation targeted more than 20 organizations, including government agencies, diplomatic missions, think tanks, and defense contractors. Microsoft previously linked the initial malware samples, ChocoShell and CornFlake, to the CaptiveCrunch operation. This operation is assessed as an operational sub-group of Midnight Blizzard, also known as Storm-2945. ReversingLobs researchers identified these samples in their analysis, expanding two published hashes into a wider campaign map that connects phishing domains to staging servers.
Cost and compliance
The source material does not provide specific financial loss figures or regulatory compliance impacts for this incident. Researchers from ReversingLabs published their findings on October 15, linking the samples to a staging server and five additional PowerShell builds. Their analysis identified two shortcut lures and connections between phishing domains and servers. However, the file analysis does not independently prove the actor’s identity, relying instead on behavioral similarities and infrastructure overlaps with known Midnight Blizzard activities.
Our take on the response
Defenders should prioritize behavioral analysis over static file signatures when investigating potential AI-assisted malware. Since attackers can rapidly regenerate code to alter hashes, focusing on command-and-control infrastructure and execution patterns provides more reliable detection. Monitoring for known malicious behaviors, such as execution policy changes and encoded script execution, remains critical for identifying these campaigns before they establish long-term persistence within targeted environments.
What defenders should look for
Teams usually detect this activity by monitoring for unusual PowerShell execution policies and Base64-encoded command strings. Security analysts should check for processes that hide their windows or interact with Windows Management Instrumentation to access shadow copies. Look for connections to known malicious staging servers or domains linked to phishing campaigns. Containment moves typically involve isolating affected endpoints and blocking identified command-and-control infrastructure to prevent further data exfiltration or lateral movement within the network.
What to do and how to stay safe: Midnight Blizzard
- Monitor network traffic for connections to newly registered domains or servers associated with known phishing campaigns.
- Review PowerShell logs for execution policy changes and the use of encoded commands that may indicate stager activity.
- Inspect endpoints for processes that hide their graphical interface or interact with system shadow copies via WMI.
- Update threat intelligence feeds to include infrastructure indicators linked to AI-rebuilt malware variants.
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attackers use AI to write the initial malware code?
Anthropic stated the operator used Claude to find, change, and redeploy detected implants, extending beyond just writing code to include phishing and data collection.
What specific malware samples were identified in this campaign?
Researchers identified ChocoShell, a PowerShell stager, and CornFlake, a Windows backdoor written in Go, as the starting samples for the campaign.
Can file hash changes prevent detection of these attacks?
No, changing a file’s code and hash did not erase shared behavior and server links that helped investigators trace the campaign to its source.
