New ReversingLabs research shows the delivery server behind a Midnight Blizzard-linked espionage campaign was still handing out malware weeks after Microsoft and Anthropic exposed it. The infrastructure includes a domain dressed up as London think tank Chatham House and, according to the researchers, a primary command server hosted with a UK provider.
What happened
ReversingLabs (RL) has published a detailed hunt that began with two file hashes and ended with a far larger map of a Russian-linked intrusion set. The starting point was Anthropic’s September 2026 threat intelligence report, which described an espionage operator it calls GTG-20006. Anthropic said that activity was consistent with public reporting linking the operator to Midnight Blizzard, the Russian group better known to many as APT29 or Cozy Bear. Six weeks earlier, on 31 July, Microsoft had documented the same infrastructure as CaptiveCrunch and pinned it on Storm-2945, a cluster it places inside Midnight Blizzard.
The new material is what RL found beyond those two reports. Working outward from the published hashes, its researchers identified the operator’s staging server, five further rebuilt versions of the PowerShell stager, two lure files, two files the server had delivered and the resolution links tying phishing domains to their servers. According to RL, Anthropic’s appendix lists none of these, and Microsoft’s report omits most of them.
The headline finding is that the operation had not been shut down. When RL tested the staging paths on 5 October 2026, more than eight weeks after Microsoft’s disclosure, the server answered normally and served a file RL classifies as malicious on each request. Several phishing domains were also still reachable. That is a dated snapshot, not proof the kit is live today.
The technical picture
The two seed samples play different roles. ChocoShell is an in-memory PowerShell stealer that, per Microsoft’s description as reported by Security Affairs and Zscaler, harvests browser credentials and Microsoft 365 and Entra ID tokens from the Windows token broker cache. CornFlake is a Go backdoor with keylogging, screen capture and file theft, and layered persistence through a fake “Cloud Sync Service” and registry Run keys.
RL’s contribution is in how the cluster was traced. Rather than rely on hashes, the team wrote a hunting rule around the beacon path and the stage labels the stager reports back to its server. Those labels are operator choices that must match server-side parsing code, so they are expensive to change. The rule returned seven PowerShell files, all malicious. The five rebuilt stagers carried five different hashes but, in RL’s analysis, an identical 35-item capability profile.
That matters because of Anthropic’s original claim: that the operator used Claude to rework implants once security products flagged them. RL saw the five builds arrive over 25 days between 9 July and 3 August, which it says is consistent with a rebuild loop, while stressing its data cannot show what produced them.
The lure files are a sharp lesson for anyone relying on antivirus. They are 60-byte Windows Internet Shortcut files containing nothing but a link to the stager. With no code inside, none of 37 engines flagged them, and even RL’s own consensus verdict still rated them as goodware in late September. Their danger lies entirely in where they point.
Upstream, Microsoft’s account of CaptiveCrunch begins with hijacked captive portals at hotels, conference centres and other shared venues. Travellers trying to get online are redirected to Microsoft 365 lookalike sign-in pages, device-code phishing flows or fake update pages using the ClickFix technique. RL did not observe that stage itself but says its findings are consistent with it. According to GBHackers, a Microsoft update on 5 October also flagged fresh activity from late September and a CornFlake build written in Rust; I could not corroborate that elsewhere.
Why it matters for UK organisations
The UK threads here are not incidental. Among the lookalike domains RL catalogued is chathamhouse[.]eu, impersonating the London international affairs institute. Together with a fake Ukrainian chamber of commerce and spoofed embassy and expatriate senders, it matches the targets Anthropic described: over 20 government, diplomatic, defence-industrial and think-tank bodies, largely in Ukraine and Europe. Anyone in the UK policy, foreign affairs or defence supply chain who corresponds with Chatham House should treat an unexpected link to that domain as hostile.
RL also reports that the primary command server sits with Tornado Datacenter in the UK. State operators happily rent capacity in friendly jurisdictions, so geo-blocking is no substitute for blocking specific indicators.
Then there is travel. UK civil servants, consultants and defence suppliers attend conferences and stay in hotels across Europe and beyond. The CaptiveCrunch method needs no foothold on the victim’s corporate network at all, only a laptop connecting to Wi-Fi the attacker controls.
Expert view
Three things stand out to me. First, the persistence of the infrastructure. Here, a server named in two major reports kept serving payloads for weeks. Publication is not takedown, and blocklists should not be quietly retired because a campaign has “been reported”.
Second, reputation scoring failed badly. RL found most of the cluster’s servers flagged by a handful of roughly 50 third-party sources, and the median malicious domain by just two. Any control that waits for a consensus verdict would have waved this traffic through. In my experience, tracking relationships and behaviours gives far more value than hash lists.
Third, the target is identity, not the endpoint. Device-code phishing produces a session that has already satisfied MFA, because the victim completes the factor on Microsoft’s genuine sign-in page on the attacker’s behalf. When we test Entra ID tenants, the device-code flow is frequently left enabled for every user despite almost nobody needing it. That single setting does much of the attacker’s work.
What to do now
- Block device-code authentication with a Conditional Access policy for all users who do not demonstrably need it, and review Entra ID sign-in logs for device-code events since May 2026. This maps to the Cyber Essentials user access control theme.
- Load the RL indicators, including the staging server, Microsoft 365 lookalikes and chathamhouse[.]eu, into firewall, proxy and DNS blocklists, and search historical logs for any contact. Treat the Madrid address RL flags as a hunting lead to validate, not an automatic block.
- Hunt for behaviour, not hashes: hidden PowerShell windows, Base64-decoded execution, HTTPS beacons to bare IP addresses and processes reading browser profiles or the Teams cache.
- Control inbound shortcut files. Strip or quarantine .url attachments at the mail gateway, as part of your malware protection controls.
- Brief travelling staff. Use mobile hotspots or an always-on VPN instead of venue Wi-Fi, and never run an “update”, certificate or command a captive portal offers.
- Revoke and reissue tokens for any account showing suspicious sign-ins, since stolen refresh tokens survive a password reset alone.
Bottom line
ReversingLabs has shown a Midnight Blizzard-linked operation keeping its delivery chain alive long after exposure, rebuilding its stager to beat hash detection and using a Chatham House lookalike to reach policy targets. For UK organisations the response is unglamorous but effective: switch off device-code sign-in where it is not needed, block the indicators and do not assume that a published campaign is a finished one.
Sources
- ReversingLabs: How RL mapped a Midnight Blizzard-linked campaign from two hashes
- GBHackers: Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
- Zscaler: CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
- Security Affairs: Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens
