Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure

A staging server tied to a Midnight Blizzard-linked malware campaign was still delivering malicious files on Oct. 5, weeks after Microsoft and Anthropic publicly reported the activity, according to ReversingLabs research reported by GBHackers. ReversingLabs found five more builds of the ChocoShell PowerShell stager used alongside the CornFlake Go backdoor, and says conventional reputation signals for the campaign’s servers were weak.