Key points
- A server linked to Midnight Blizzard delivered payloads on 5 October 2026, eight weeks after disclosure.
- Attackers used innocuous Internet Shortcut files to bypass antivirus detection and trigger PowerShell stagers.
- The activity is tracked by Microsoft as CaptiveCrunch and attributed to the Storm-2945 cluster.
Managed service providers should understand that public disclosure of threat infrastructure does not guarantee its immediate takedown. A server associated with the Midnight Blizzard cluster was still hosting malicious files in early October 2026. This persistence allows attackers to maintain operational capability even after their methods are widely known.
In plain English
The core issue involves the longevity of attacker infrastructure. Despite public reporting and low reputation scores, the server continued returning successful responses for payload requests. This means that simply identifying a threat in the news does not neutralise it. Security teams must assume that known malicious endpoints may remain functional for extended periods, complicating threat hunting efforts.
The background
ReversingLabs connected samples to a staging server after searching historical telemetry for hashes published by Anthropic. The files included ChocoShell, a PowerShell stager, and CornFlake, a Go backdoor. Microsoft tracks this activity as CaptiveCrunch, attributing it to Storm-2945. Anthropic previously reported that the operator used AI tools to modify implants after detection.
What changes now
The finding demonstrates that public awareness does not automatically lead to infrastructure shutdown. Analysts observed five distinct stager builds with different hashes, suggesting repeated rebuilding. The use of simple Windows Internet Shortcut files allowed the attackers to evade traditional antivirus engines, as these files contained no executable code. Their danger lay solely in the URLs they opened, which downloaded the actual malicious software.
The attacker's path
In this type of intrusion, the attacker relies on social engineering to deliver lightweight files that bypass initial security controls. The weakness exploited is often the trust placed in common file formats like Internet Shortcuts. This stage serves as the initial access vector, bridging the gap between a user action and the execution of remote code. Teams usually monitor for unusual outbound connections from standard utilities. Check whether your endpoints allow unrestricted URL execution from downloaded files.
What to do and how to stay safe: Midnight Blizzard
- Review proxy logs for connections to known malicious IP addresses, even if they appear in older threat reports.
- Inspect Windows Internet Shortcut files in email attachments and download directories for suspicious URLs.
- Monitor for PowerShell execution that originates from unexpected or non-standard processes.
- Verify that security tools are configured to block or alert on scripts executed from temporary directories.
Step-by-step guide: Ransomware Recovery Plans: 6 Misunderstandings That Block Restoration
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Midnight Blizzard server still active?
Yes, the server was delivering payloads on 5 October 2026, eight weeks after the initial disclosure.
How did the attackers bypass antivirus detection?
They used Windows Internet Shortcut files that contained no executable code, only URLs to the malicious payloads.
Who is attributed to this activity?
Microsoft attributes it to Storm-2945, an operational sub-cluster of Midnight Blizzard, tracked as CaptiveCrunch.
