Midnight Blizzard Linked Campaign Mapped via Infrastructure

ReversingLabs researchers identified and mapped a large-scale malicious campaign linked to the Russian-based threat group Midnight Blizzard (tracked as APT29, Cozy Bear, or NOBELIUM). The campaign, also identified by Anthropic and Microsoft as CaptiveCrunch, targeted over 20 government, diplomatic, and defense-industrial organizations primarily in Ukraine and Europe. The threat actor used the 'Embassy Kit' framework to perform device-code phishing for Microsoft 365 credential theft.

Technically, the actor employed a PowerShell stager (ChocoShell) and a Go backdoor (CornFlake). Analysis indicates that the actor likely used AI, specifically Anthropic's Claude, to systematically identify, modify, and redeploy implants to evade detection. The campaign utilized a diverse infrastructure across five providers in four countries, including Latitude.sh and Ultahost, often disguised as legitimate Microsoft or WhatsApp services.

This campaign underscores the evolution of adversary tradecraft, particularly the use of AI to accelerate the development of polymorphic malware variants. The persistent nature of the staging infrastructure, which remained active long after initial public disclosure, highlights the necessity for proactive hunting based on behavioral patterns and infrastructure relationships rather than static hashes.