Midnight Blizzard Linked to Large-Scale Espionage Campaign

Summary

ReversingLabs identified a large-scale espionage campaign associated with the Russian threat group Midnight Blizzard. The operation uses a PowerShell stager known as ChocoShell and a Go-based backdoor called CornFlake to steal credentials and maintain persistence. The threat actor reportedly leveraged Claude AI to rebuild and redeploy software implants in an effort to evade detection.

Investigation

Researchers expanded two initial malware hashes through telemetry analysis, uncovering a staging server, five additional stager variants, lure documents, and related phishing infrastructure. The investigation showed that although malware hashes changed frequently due to AI-assisted rebuilds, the core behavior and C2 communication patterns remained largely consistent across samples.

Mitigation

Organizations should review Microsoft Entra ID sign-in activity for suspicious device-code authentication attempts. Blocking device-code flows through Conditional Access is recommended where operationally feasible. Security teams should also implement network-level blocking for identified C2 IP addresses and malicious lookalike domains associated with the campaign.

Response

When malicious activity is detected, responders should investigate potential Microsoft 365 token theft and device-code phishing attempts. Check for unauthorized service creation and suspicious processes executing from LocalAppData. Review PowerShell script blocks for embedded raw IP addresses, unusual commands, and specific stage labels linked to the observed attack chain.

Simulation Execution

• Attack Narrative & Commands: The adversary seeks to establish persistence and evade detection by masquerading as a legitimate Windows service component. The attacker creates a directory structure AppDataLocalMicrosoftsvchost32 and drops a malicious binary named svchost32.exe. By using a name similar to the legitimate svchost.exe, the attacker hopes to blend into the noise of a busy system. Once placed, the binary is executed to simulate the Go-based backdoor activity.

• Regression Test Script:

  # Simulation script for Midnight Blizzard svchost32.exe detection
  $targetDir = "$env:LOCALAPPDATAMicrosoftsvchost32"
  $executableName = "svchost32.exe"
  $executablePath = Join-Path $targetDir $executableName
  
  # 1. Create the directory structure
  if (!(Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force | Out-Null
      Write-Host "[+] Created directory: $targetDir"
  }
  
  # 2. Create a dummy file to represent the malware (mimicking the filename/path)
  # In a real scenario, this would be the actual Go backdoor binary
  New-Item -Path $executablePath -ItemType File -Force | Out-Null
  Write-Host "[+] Created dummy executable: $executablePath"
  
  # 3. Execute the "malware" to trigger the Sysmon Event ID 1
  Write-Host "[!] Executing simulated backdoor..."
  Start-Process -FilePath $executablePath -ArgumentList "/silent" -ErrorAction SilentlyContinue
  Write-Host "[+] Execution complete. Check SIEM for detection."

• Cleanup Commands:

  # Cleanup script to remove simulated artifacts
  $targetDir = "$env:LOCALAPPDATAMicrosoftsvchost32"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
      Write-Host "[+] Removed simulation directory and files: $targetDir"
  } else {
      Write-Host "[-] Directory not found, nothing to clean."
  }