The Malware Rebuilt Itself After Detection

EVIDENCE — Anthropic’s 10 September 2026 Threat Intelligence Report describes GTG-20006, an operator whose tradecraft and targeting it says are consistent with Russian state-linked espionage and public reporting on Midnight Blizzard. Anthropic observed the actor target more than 20 organizations in government, defense, diplomacy, intelligence, research, and the drone supply chain. The campaign used AI-assisted workflows across infrastructure acquisition, reconnaissance, phishing, persistence, command and control, credential theft, lateral movement, and data exfiltration. Anthropic says it disrupted the associated Claude activity and shared intelligence where appropriate.

THE LOOP CLOSED AROUND THE DETECTION — The most consequential change was not simply that AI helped write malware. Anthropic says the actor used AI agents to monitor whether deployed implants were detected by security products. When a detection appeared, the agents modified and rebuilt the artifacts, then iterated until they were undetected and ready to stage again. Humans still selected targets and refined the Claude Code skills driving the workflows, but parts of the detect–change–retest cycle were automated. That converts a defender’s static signature from a lasting cost into feedback for the attacker’s next build.

ATTRIBUTION HAS A BOUNDARY — Anthropic labels the group GTG-20006 and says its attribution is consistent with Midnight Blizzard reporting; it does not present that phrasing as an independently adjudicated identity. Microsoft separately attributes the related CaptiveCrunch activity to Storm-2945, a Midnight Blizzard sub-cluster, and says it observed the actor using AI to support a significant portion of operations. The two reports overlap on device-code phishing, hospitality-network manipulation, credential theft, malware delivery, and technical indicators. That alignment strengthens the campaign context without proving that every artifact or action described by Anthropic came from one operator.

STATIC MATCHING IS NOW A SHORTER-LIVED ADVANTAGE — Signatures still matter: both reports publish domains, IP addresses, hashes, filenames, and behavioral hunting queries that can identify known infrastructure and implants. But an automated rebuild loop makes hashes and other brittle indicators decay faster. Durable detection needs to follow behavior and identity as well as files: suspicious device registration, anomalous OAuth device-code use, fake update and ClickFix execution chains, security-update suppression, unusual mailbox export, new persistence, unexpected bulk collection, and repeated malware builds that change immediately after an endpoint alert.

WHAT TO CHECK — Ingest Anthropic’s published IOC file and Microsoft’s CaptiveCrunch indicators, but attach expiration and review dates rather than treating them as permanent truth. Hunt for the named infrastructure, PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc, CornFlake, ChocoShell, GiftDrop, and DarkSword, then pivot from any match to identity, endpoint, email, DNS, and cloud telemetry. Restrict device-code flow where it is unnecessary; require phishing-resistant MFA and controlled device registration; protect security-update services from local tampering; and alert when a newly detected binary is followed by rapid, functionally similar variants. Measure whether detections force the adversary to change behavior—not merely whether the current hash disappears.