Midnight Blizzard Server Delivers Payloads Eight Weeks After Initial Disclosure
A staging server linked to Storm-2945 continues to serve malicious files, proving that public disclosure does not guarantee infrastructure takedown.
Key points
- A server at 213[.]145[.]86[.]112 served malicious payloads on October 5, 2026.
- The infrastructure supports Windows Internet Shortcuts that launch PowerShell stagers.
- Microsoft attributes the activity to Storm-2945, a sub-cluster of Midnight Blizzard.
A server associated with the Midnight Blizzard threat cluster was actively delivering malicious files on October 5, 2026. This activity occurred eight weeks after the initial public disclosure of the campaign. The finding indicates that threat actors may maintain operational infrastructure long after security researchers publish their findings.
According to GBHackers, the server at IP address 213[.]145[.]86[.]112 returned HTTP 200 responses for multiple payload paths. These paths include those used by simple Windows Internet Shortcut files. The shortcuts trigger the download and execution of a PowerShell stager. This behavior demonstrates that low reputation scores for an IP address do not necessarily correlate with an offline status for the underlying malware infrastructure.
Attribution and Technical Details
Microsoft tracks this specific activity under the name CaptiveCrunch. The vendor attributes the operations to Storm-2945, which it assesses as an operational sub-cluster of the broader Midnight Blizzard group. ReversingLabs describes the activity as Midnight Blizzard-linked. The analysis team stated that its file examination neither confirms nor contradicts Microsoft’s specific attribution.
ReversingLabs researchers connected two malware samples to the staging server. These samples included a PowerShell stager identified by Microsoft as ChocoShell and a Go backdoor known as CornFlake. ReversingLabs first observed the backdoor on July 6 and the stager on July 10. Both observations occurred weeks before the public reports were released.
Analysis and Detection Challenges
ReversingLabs classified both files as malicious on August 1, the day after Microsoft published its findings. A behavioral hunt based on distinctive beacon paths and labels identified five additional stager builds with different hashes. These samples shared a 35-item capability profile. Capabilities included hidden PowerShell execution, Base64-decoded code execution, browser-history collection, and beaconing to the same server.
The five builds reached ReversingLabs telemetry between July 9 and August 3. This pattern is consistent with repeated rebuilding of the implants. ReversingLabs noted that its data cannot establish whether artificial intelligence produced these variations. Anthropic previously reported that the operator used Claude to modify and redeploy implants after detection by security products.
Further investigation revealed two short Windows Internet Shortcut files pointing to stager download paths. These shortcuts contained no executable code. Consequently, antivirus engines did not flag them. Their malicious significance derived solely from the URLs they opened. Each request to these URLs delivered a file that ReversingLabs classified as malicious.
What should you do?
Organizations should monitor for unusual PowerShell execution and base64 decoding activities. Security teams should inspect Windows Internet Shortcut files for suspicious URLs. Network logs should be reviewed for connections to the identified IP address.
What to do and how to stay safe: Midnight Blizzard
- Monitor endpoint logs for PowerShell execution initiated by Internet Shortcut files.
- Inspect network traffic for connections to 213[.]145[.]86[.]112.
- Review browser history artifacts on endpoints for data exfiltration attempts.
- Validate that security tools detect Base64-decoded code execution patterns.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Midnight Blizzard server still active?
Yes, the server at 213[.]145[.]86[.]112 was delivering payloads on October 5, 2026.
How do the malware shortcuts bypass antivirus detection?
The Windows Internet Shortcut files contain no executable code, only URLs.
What malware variants are linked to this infrastructure?
The infrastructure hosts ChocoShell stagers and the CornFlake Go backdoor.
