ReversingLabs Maps a Midnight Blizzard-Linked Campaign from Two Malware Hashes

Oct 15, 2026 · Original article ↗

Summary

ReversingLabs traced two Anthropic-published malware hashes to additional stagers, delivery shortcuts and infrastructure. Its analysis found the staging server still serving malware on October 5, while noting that some links to the campaign remain uncertain.

Key points

RL says it first observed the Go backdoor on July 6, 2026, and the PowerShell stager on July 10—weeks before Microsoft and Anthropic published their reports.
A YARA retro-hunt using the stager’s beacon path and labels found seven PowerShell files, including five rebuilt stagers; RL assessed some links to the cluster with only moderate confidence.
The stager used HTTPS beacons to 213[.]145[.]86[.]112 and collected browser history; the Go backdoor accessed browser and Teams data and had multiple persistence behaviors.
Two Internet Shortcut files pointed to stager downloads on the server. RL assessed them as malicious based on their destinations, although antivirus engines and RL’s cloud verdict did not flag the files.
RL linked phishing domains to server IPs and identified 192[.]142[.]52[.]31 as a possible backdoor address, with moderate confidence and a recommendation to validate it before blocking.
The staging server returned HTTP 200 and served a file RL classified as malicious on October 5, 2026; several phishing domains also remained reachable.
RL cautioned that its file analysis neither confirms nor contradicts the vendors’ attribution, and that telemetry cannot establish what produced the rebuilt stagers or how the Go backdoor reached victims.

Article Details

Attack Vectors: Anthropic and Microsoft report device-code phishing through Microsoft 365 lookalike domains; RL identifies ms365-live.com and owa-ms365.com as resolving to phishing servers.
Internet Shortcut (.url) files direct users to PowerShell stagers hosted on the staging server. RL assesses this link as the user-facing step of the infection chain.
The PowerShell stager hides its window, changes the execution policy, decodes and runs Base64-encoded code, collects browser history, and communicates with the staging server over HTTPS.
Microsoft reports browser credential theft, including a Chrome App-Bound Encryption bypass, and HTTPS POST exfiltration to the stager’s server.
The Go backdoor persists through an HKCU Run value and a Schedule.Service COM object, injects into a suspended process, and accesses browser profiles and the Microsoft Teams cache.
Microsoft reports that compromised hotel and venue captive portals redirected travelers to phishing domains and ClickFix pages; RL states its telemetry did not reach this stage of the chain.
Defensive Notes: Query vendor indicators against historical telemetry when reports are published, including first-seen dates and relationships between files, domains, and servers.
Review Microsoft Entra ID sign-ins for device-code authentication and block the device-code flow with Conditional Access where business requirements allow.
The article recommends blocking the servers and domains listed in its indicators, while cautioning that public disclosure does not necessarily take infrastructure offline.
Validate the published YARA and Sigma rules against a goodware corpus before deployment; the article notes specific false-positive risks for both rules.
Treat 192[.]142[.]52[.]31 as a hunting lead to validate before blocking: RL assesses with moderate confidence that the backdoor uses it.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`chamber-ua[.]org`	Lookalike domain impersonating a Ukrainian chamber of commerce; RL classifies it as malicious.
DOMAIN	`chathamhouse[.]eu`	Lookalike domain impersonating a targeted institution; RL classified it as suspicious.
DOMAIN	`m365-owa[.]com`	Microsoft 365 lookalike domain that Microsoft identifies as adversary-in-the-middle infrastructure.
DOMAIN	`ms365-device[.]com`	Microsoft 365 lookalike domain that Microsoft identifies as adversary-in-the-middle infrastructure.
DOMAIN	`ms365-live[.]com`	Microsoft 365 lookalike domain used as a device-code phishing redirect host.
DOMAIN	`owa-ms365[.]com`	Outlook Web Access lookalike domain resolving to a phishing host.
DOMAIN	`wa-meeting[.]com`	Lookalike domain impersonating WhatsApp Web pairing; RL classifies it as malicious.
IPV4	`104[.]145[.]210[.]184`	Device-code phishing VPS resolving from ms365-live[.]com.
IPV4	`104[.]194[.]159[.]150`	Server listed by Microsoft for the same operation; RL had not enriched it.
IPV4	`107[.]189[.]26[.]194`	Microsoft identifies this server as a second ChocoShell C2 and DNS resolver; RL had not enriched it.
IPV4	`192[.]142[.]52[.]31`	Moderate-confidence hunting lead; RL relationship data associates the Go backdoor with this address.
IPV4	`213[.]145[.]86[.]112`	Staging server and ChocoShell C2; served malicious stagers and received HTTPS beacons.
IPV4	`31[.]57[.]243[.]154`	Phishing host serving owa-ms365[.]com.
IPV4	`38[.]146[.]28[.]132`	Microsoft lists this server as a DNS resolver for the operation; RL had not enriched it.
MD5	`c6f4df18cb880500f3921a179c3a3766`	MD5 of the ChocoShell PowerShell stager.
MD5	`fba867df17721879df9d8dcca68d6900`	MD5 of the CornFlake Go backdoor.
SHA1	`154d8cfd9e304b6644216456759b7fd12daf85c1`	SHA-1 of a rebuilt PowerShell stager retrieved from the staging server.
SHA1	`1b97e0df9600335b0cd8db2eb4577d3dbf6e76db`	SHA-1 of a file RL places in the infrastructure-linked tier for the campaign.
SHA1	`510af9bb00ff5d4a6856b1291af55db9f6e13551`	SHA-1 of the CornFlake Go backdoor.
SHA1	`7acb7082d37854877a08999374460c9d7e5cd663`	SHA-1 of a rebuilt PowerShell stager identified by RL as part of the same toolset.
SHA1	`937e75e0e1c82eecab69e9b8ad481bd7e0845308`	SHA-1 of the ChocoShell PowerShell stager.
SHA256	`20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38`	SHA-256 of a rebuilt PowerShell stager identified by RL as part of the same toolset.
SHA256	`918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593`	SHA-256 of the CornFlake Go backdoor identified by Anthropic and analyzed by RL.
SHA256	`be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c`	SHA-256 of the ChocoShell PowerShell stager identified by Anthropic and analyzed by RL.
SHA256	`ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25`	SHA-256 of a rebuilt PowerShell stager retrieved from the staging server.
URL	`hxxps[:]//213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js?ref=95766022&stub=1`	Malicious stager download URL disguised as a JavaScript bundle and linked from a delivery shortcut.
URL	`hxxps[:]//213[.]145[.]86[.]112/s`	Malicious stager download URL served by the staging server.
URL	`hxxps[:]//213[.]145[.]86[.]112/s?r=0f511e19`	Malicious stager download URL with a session token.
URL	`hxxps[:]//213[.]145[.]86[.]112/t/pixel[.]gif?m=stage2_ctx_admin_la_true&r=r=`	PowerShell stager beacon URL carrying a context flag.
URL	`hxxps[:]//213[.]145[.]86[.]112/t/pixel[.]gif?r=&m=stage2_entry8`	PowerShell stager beacon URL identified by RL as a stage-2 indicator.