- ReversingLabs traced a wider campaign from two hashes in Anthropic's report. Five rebuilt stagers had different hashes but the same capability profile and beacon labels.
- Hash lists describe one build. Relationships between files, servers and domains survive a rebuild, and that is where ReversingLabs found its leads.
- Ask your security vendor whether it tracks relationships and history, not only hashes. Ask how you would catch a file that contains no code.
A file hash is a fingerprint. Change a single character in a file and the fingerprint changes. That makes hash lists cheap to share and easy to load into a security tool. It also makes them quick to expire when an attacker rebuilds the file.
ReversingLabs (RL) published a walk-through on October 15 showing what works instead. The researchers started with two hashes from Anthropic's September 2026 report. They ended with a map of a much larger campaign.
The lesson here is that a rebuilt file has a new fingerprint but the same job. Defenders who track the job and its connections can follow the trail. Defenders who track only fingerprints must start again with each rebuild.
What Anthropic and Microsoft reported
Anthropic describes an operator it calls GTG-20006. It says the targets numbered more than 20 and included government agencies, diplomatic bodies, policy research groups and defense suppliers, mainly in Ukraine and Europe. Anthropic says the operator gained Microsoft 365 access by getting users to approve a device-code sign-in, a login flow where a victim types a code into a real Microsoft page. Anthropic also says the operator used Claude to "identify, modify and redeploy" implants after they were detected.
Anthropic links the operator to Midnight Blizzard. Microsoft published earlier on the same infrastructure as CaptiveCrunch and tied it to Storm-2945, which it calls a sub-cluster of Midnight Blizzard. RL says its own file analysis neither confirms nor contradicts either attribution. It calls the cluster "Midnight Blizzard-linked." This story does the same.
Why a rebuild did not break the trail
RL's PowerShell stager is the first-stage script that gets a foothold. Once running, it checks in with a server at 213.145.86.112. The check-in looks like a request for a tiny tracking image, and its query string tells the server which stage the script has reached.
The stage labels are the operator's own choices. The server-side code has to parse them. So changing a label means changing two systems at once. A rebuild can scramble the file. It cannot easily scramble the agreement between the script and its server.
RL wrote a detection rule on the beacon path and two stage labels. A search of its history returned seven PowerShell files, all classified malicious. Five of them are rebuilt stagers. RL says those five carry one identical profile of 35 capabilities despite five different hashes.
The file that holds no code
RL also found two Windows shortcut files. Each is 60 bytes and holds only a link to a stager on the staging server. They are the steps a victim has to click.
None of 37 antivirus engines flagged either one. RL's own cloud verdict still read goodware on September 28. RL calls this a gap in its own product. The shortcuts have no code, so their intent shows only in where they point.
One search did not work. Looking for the server's address as plain text returned 82 files over a year. None were the stagers, because RL says they do not carry the address as a literal string. The searches that succeeded all traced links between files, servers and domains.
What the evidence supports, and what it does not
RL ties four files to the cluster with high confidence: two stagers served from the staging server and the two shortcuts. The other three stagers share the code and labels but have no observed network link. RL rates those as moderate confidence because another party could have reused the template.
On timing, RL says it first saw the Go backdoor on July 6 and the stager on July 10. Microsoft published on July 31 and Anthropic on September 10. RL's data is consistent with Anthropic's account of repeated rebuilding. It does not prove which tool made the changes.
This is a vendor's account of its own telemetry, and RL sells the product it describes. Still, it publishes its hashes, rules and queries so others can check them.
Questions for your security team
Ask whether your tools block on hash lists alone, or also use behavior, history and links between files, servers and domains. A hash list describes one build. A relationship map covers the next one too.
Ask how you would detect a file that contains no code but points to one that does. Ask whether your Microsoft 365 setup allows device-code sign-in at all, since Anthropic reports that route in this campaign. Ask how long your vendor held a sample before a verdict reached you.
Rebuilding a file is cheap. Changing what it must do and which server it must call is harder, and RL's five builds kept both. That is where detection effort pays off.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ReversingLabs.
