#midnight-blizzard
2 cases
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was CaughtState-SponsoredAI & Machine Learning
Anthropic's September threat report describes a Midnight Blizzard-linked operator running eight AI workflows — phishing, hotel Wi-Fi hijack, malware evasion — against 24 targets in Ukraine and Europe. Microsoft's CaptiveCrunch report, from the other side, lists four of the same domains.
State-SponsoredAI & Machine Learning
Midnight Blizzard (APT29): Russian State-Sponsored Breach of Microsoft Corporate SystemsState-SponsoredData Breach
Russian state-sponsored group Midnight Blizzard (APT29) breached Microsoft's corporate environment via password spray against a legacy non-production test tenant, accessed executive and security team email, and exfiltrated OAuth tokens and source code — demonstrating sophisticated identity-based tradecraft without malware.
State-SponsoredData Breach