Check for Midnight Blizzard Shortcuts and PowerShell Stagers on Your PC
Malware servers linked to the Storm-2945 cluster continue delivering payloads weeks after initial disclosure, requiring users to inspect system shortcuts.
Key points
- A server associated with Midnight Blizzard activity delivered malicious files on October 5, 2026, eight weeks after public disclosure.
- Attackers used Windows Internet Shortcut files to bypass antivirus detection and launch PowerShell stagers that connect to command-and-control infrastructure.
- ReversingLabs identified multiple stager builds and a Go backdoor sharing a capability profile that includes browser-history collection and beaconing.
If you use Windows systems, your browser history and system shortcuts may have been targeted by actors linked to the Midnight Blizzard cluster. This group, tracked by Microsoft as Storm-2945 and CaptiveCrunch, continues to operate infrastructure that delivers malware. Users should understand that public disclosure of such campaigns does not guarantee the immediate removal of malicious servers or the end of the threat to their personal devices.
What kind of files are being delivered?
The primary delivery mechanism involves simple Windows Internet Shortcut files. These files contain no executable code, which allows them to evade standard antivirus scanning. Instead, they store URLs that, when opened, trigger the download of malicious payloads. On October 5, 2026, a server linked to this campaign returned successful responses for these paths. The downloaded files include PowerShell stagers and a Go-based backdoor known as CornFlake, which beacon to the attacker’s infrastructure.
How did researchers identify this ongoing activity?
ReversingLabs traced the activity by analysing two malware hashes originally published by Anthropic. By searching its historical telemetry, the firm connected these samples to a staging server at 213[.]145[.]86[.]112. The analysis revealed five additional stager builds with different hashes, all sharing a 35-item capability profile. These capabilities include hidden PowerShell execution, Base64-decoded code execution, and the collection of browser history. The samples reached ReversingLabs’ systems between July 9 and August 3, 2026, suggesting repeated rebuilding of the implants.
What is the connection to artificial intelligence?
Anthropic reported in September that an operator, referred to as GTG-20006, used the Claude model to modify and redeploy implants after detection by security products. While ReversingLabs states its data cannot confirm whether AI produced the specific stager builds it found, the pattern of repeated rebuilding is consistent with such automated modification. The operator is assessed by Microsoft as an operational sub-cluster of Midnight Blizzard, a group described by Anthropic as an espionage operator.
Why does this matter for individual users?
The persistence of this infrastructure demonstrates that low reputation scores and public disclosure do not necessarily result in the takedown of malicious servers. The server continued to deliver payloads eight weeks after public disclosure. For users, this means that links or shortcuts received during this period may still be active threats. The use of benign-looking shortcut files lowers the barrier for infection, as users may not suspect a harmless-looking file of containing malicious URLs that lead to remote code execution.
What affected people can do
Teams usually advise affected individuals to inspect their desktop and start menu for unfamiliar Internet Shortcut files, particularly those with generic names or icons. Check whether any recent email attachments or downloaded links resulted in new shortcut files being created. Verify that your antivirus software is updated to the latest definitions, as older versions may miss these file types. Be wary of follow-up communications claiming to offer removal tools for this specific malware; these are often scams designed to steal credentials. Report any suspicious activity to your local IT support immediately.
What to do and how to stay safe
- Review your Windows desktop and start menu for any Internet Shortcut files (.url) you do not recognise or did not create yourself.
- Check your browser history for visits to unfamiliar domains during July and August 2026, as these may indicate exposure to the stager downloads.
- Ensure your operating system and antivirus software are fully updated to protect
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
