Here is where AI and security collide. In its September threat report, Anthropic described an operator it calls GTG-20006 — attribution “consistent with” Russia’s Midnight Blizzard — that used Claude to identify, modify and redeploy malware after security tools flagged it. On October 15, ReversingLabs published how it took the two file hashes Anthropic shared and mapped out a much bigger campaign.
What RL found
Starting from a PowerShell stager (Microsoft calls it ChocoShell) and a Go backdoor (CornFlake), RL pivoted to the operator’s staging server, five rebuilt stager builds with five different hashes that showed up in 25 days, two tiny .url lure files, and links between phishing domains and servers. The targets: more than 20 government, diplomatic, think-tank and defense-industrial organizations, mostly in Ukraine and Europe, hit with Microsoft 365 device-code phishing from a framework called Embassy Kit.
Why this matters
The rebuilds changed the hashes and broke fuzzy-hash matching on one variant. What did not change was the behavior: the same beacon path and stage labels, the same capability profile. RL’s YARA rule keyed on those operator-chosen strings and kept finding new builds. The 60-byte lure shortcuts contained no code, so none of 37 antivirus engines flagged them.
That is the lesson for the AI era. If attackers can regenerate a binary on demand, hash-based blocklists get weaker fast. Hunt on behavior and relationships.
Do this
RL’s top recommendation: review Entra ID sign-ins for device-code authentication and block the device-code flow with Conditional Access wherever your business allows it. Everything else in this campaign sits downstream of that one door. RL also says the staging server was still serving the stager on October 5, so don’t assume disclosure took the infrastructure down.
Have a blessed day! And Happy Hacking!