Investigating Midnight Blizzard's AI Powered Infrastructure
Investigating Midnight Blizzard infrastructure to reveal additional indicators of compromise.
CaptiveCrunch Campaign
The threat intelligence team from Microsoft has recently published an article describing a campaign of traffic manipulation attacks leading to credential theft and malware delivery. This campaign has been attributed by Microsoft to a group called Storm-2945, which, according to Microsoft, is a part of Midnight Blizzard. Midnight Blizzard itself has been attributed to the Russian SVR (foreign intelligence).
This is especially interesting, as an article by ReliaQuest,also referenced by Microsoft, attributes the same campaign to APT28/Fancy Bear/Forest Blizzard. This group has been connected to the Russian GRU (military intelligence). This could be just a case of misattribution, but APT28 has previously been connected to similar network traffic manipulation activity. If the attribution by Microsoft is correct, this means both groups are using similar techniques, which is a very interesting development.
The article describes the campaign dubbed “CaptiveCrunch”, which includes ClickFix-type social engineering attacks delivering malicious payloads as well as device code and OAuth code phishing. Infrastructure identified by Microsoft and a C2 panel used in the attack is also described.
For the purpose of this investigation, only these network indicators identified in the article are relevant.
| Indicator | Description | First seen |
| ms365-device[.]com | CaptiveCrunch DCF redirect | 2026-07-23 |
| ms365-live[.]com | CaptiveCrunch DCF redirect | 2026-05-14 |
| m365-owa[.]com | CaptiveCrunch AitM infrastructure | 2026-07-20 |
| owa-ms365[.]com | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 31.57.243[.]154 | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 38.146.28[.]75 | CaptiveCrunch AitM infrastructure | 2026-07-01 |
| 38.146.28[.]132 | CaptiveCrunch DNS Resolver | 2026-07-15 |
| 104.194.159[.]150 | CaptiveCrunch AitM infrastructure | 2026-04-28 |
| 107.189.26[.]194 | ChocoShell C2 / CaptiveCrunch DNS Resolver | 2026-02-27 |
| 213.145.86[.]112 | ChocoShell C2 | 2026-07-01 |
Service Analysis
The services present on each of the hosts were analyzed to identify possible fingerprints. Some of them showed especially interesting services and provided opportunities for pivoting and analysis.
38.146.28[.]132 and 107.189.26[.]194 both had an HTTP service responding with the title “DNS Server Manager” which aligns with their role as DNS resolvers identified by Microsoft. Coincidentally, this proved to be a particularly distinctive indicator as they were the only hosts identifiable from across the Internet with this title.
104.194.159[.]150 hosted a service with the title “Service Unavailable — Scheduled Maintenance”. Across the internet, this title is shared only with one other IP address: 104.145.210[.]184, which was not identified by Microsoft.
In addition to hosting a service with the same title, the service also had a certificate for the threat actor’s domain ms365-live[.]com at the same port, further linking it to the same threat actor’s infrastructure.
The IP address 213.145.86[.]112 had a service with the title “Authentication Required”, which is not very unique, but interestingly the server responded with the HTTP header “Blue Team Dashboard” and the HTML body the server replied with contains the text “Blue Team Training Kit”. The rendered HTML that the server responds with is stylistically somewhat similar to what was shown in the Microsoft article in reference to a management panel. Graphically both have a similar feel to what some LLMs create, which I believe Microsoft is at least partially referring to in their article with “Microsoft has observed Storm-2945 leveraging AI to support a significant portion of these operations.”
This combination of the title, header and HTML reply can also be identified in one other IP address: 45.59.114[.]253. Thus, this IP is also strongly linked to the threat actor. The IP was not identified by Microsoft.
Domain Analysis
As identified in the ReliaQuest article, the domains m365-owa[.]com, owa-ms365[.]com and ms365-device[.]com share the same registration email address of chikolimdrid@gmail[.]com. The same email address can be seen in the SOA record for each of these domains. As has been established from these initial articles, these domains are clearly linked. No further useful information could be gathered from them.
Investigating the historical DNS data reveals that the IP address 104.194.159[.]150, initially identified as part of the CaptiveCrunch AitM infrastructure, resolved to the domain my-invite[.]org between April 28th and May 13th. This domain was not listed as part of the initial indicators. The domain has also been used for what appears to be a lure site hosted at the same IP address 104.194.159[.]150. The site has been seen with at least two different lure messages. One of the messages claims to be an invitation to an event hosted by GLOBSEC, a think tank based in Slovakia, and the other one claims to be an invitation to an event from University College London.
Note how both lure messages state that users need to be identified with their institution’s Microsoft accounts. This sets up the visitor to expect that they will likely be prompted for their credentials.
Historical DNS records also reveal another previously unseen domain statistic-g[.]com. This domain has resolved to 107.189.26[.]194, which was initially identified as ChocoShell C2/CaptiveCrunch DNS Resolver, since February 27.
Interestingly, another Gmail email address afbenzyyy@gmail[.]com can be found in this domain’s SOA record.
Another previously unseen domain o365bd3417a777636[.]com can be identified through historical DNS data. The domain resolved to 38.146.28[.]132 since May 11th. This IP address was initially identified as CaptiveCrunch DNS Resolver. The domain has also resolved to a previously unseen IP address 45.88.186[.]46 between February 16th and May 11th.
During this time, connections to a subdomain login.o365bd3417a777636[.]com can be seen being redirected to an official Microsoft login URL.
However, connections to the same subdomain on May 12th, after the domain started to resolve to 38.146.28[.]132, were redirected to a YouTube video. If you have been around the internet for a while, you might even recognize the URL. It is indeed the infamous Rick Roll video.
Now I will be the first to admit that if this was the threat actor trolling a victim or me, it is pretty funny. But there is another explanation. The Evilnginx tool used by threat actors and red teams in phishing attacks has a feature that redirects unwanted visitors to another URL, this URL by default is the Rick Roll video.
I would say it is more likely that this part of the phishing infrastructure was simply in the process of being set up, rather than the representatives of the Russian intelligence services having a sense of humor.
Conclusion
The article describing the CaptiveCrunch Campaign proved to be a great source of indicators to investigate and pivot on. The relative ease with how additional domain and IP address indicators could be gathered, the rather bizarre sites set up for some of the C2 servers and DNS resolvers as well as the hints from Microsoft about AI usage by the threat actors leaves me to wonder if these fingerprints and pivot points identified here are the result of going fast and using AI. It is also possible this is just one campaign among many that for whatever reason was identified and relatively simply mapped out. Only time will tell.
Update - 06.08.2026
After publishing this blog post I’ve come across two additional hosts that are part of this campaign. The first host that I identified was 192.142.52[.]31 from threat reporting regarding this campaign. This IP was hosting the CloudSync Console described by the initial Microsoft article.
Pivoting from the HTTP title of CloudSync Console, it was possible to identify an additional host at 31.57.35[.]228 with the same panel. These two hosts have now been added to the table below.
Initial indicators:
| Indicator | Description | First seen |
| ms365-device[.]com | CaptiveCrunch DCF redirect | 2026-07-23 |
| ms365-live[.]com | CaptiveCrunch DCF redirect | 2026-05-14 |
| m365-owa[.]com | CaptiveCrunch AitM infrastructure | 2026-07-20 |
| owa-ms365[.]com | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 31.57.243[.]154 | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 38.146.28[.]75 | CaptiveCrunch AitM infrastructure | 2026-07-01 |
| 38.146.28[.]132 | CaptiveCrunch DNS Resolver | 2026-07-15 |
| 104.194.159[.]150 | CaptiveCrunch AitM infrastructure | 2026-04-28 |
| 107.189.26[.]194 | ChocoShell C2 / CaptiveCrunch DNS Resolver | 2026-02-27 |
| 213.145.86[.]112 | ChocoShell C2 | 2026-07-01 |
| chikolimdrid@gmail[.]com | Email used in SOA record & Domain registration | 2026-07-01 |
Additional indicators:
| Indicator | Description | Confidence level | First seen |
| 104.145.210[.]184 | Shares service & certificate with 104.194.159[.]150 | High | 2026-07-20 |
| haleronstudios[.]com | 104.145.210[.]184 resolved to domain since Nov 2025 | Medium | 2025-11-02 |
| my-invite[.]org | 104.194.159[.]150 resolved to domain & hosted lures | High | 2026-04-28 |
| o365bd3417a777636[.]com | 38.146.28[.]132 resolved to domain & phishing adjacent | High | 2026-02-16 |
| 45.83.31[.]117 | o365bd3417a777636[.]com resolved for a short period | Medium | 2026-02-15 |
| 45.88.186[.]46 | o365bd3417a777636[.]com resolved | Medium | 2026-02-16 |
| statistic-g[.]com | 107.189.26[.]194 resolved to domain | High | 2026-02-27 |
| afbenzyyy@gmail[.]com | SOA record for statistic-g[.]com | Medium | 2026-02-26 |
| 45.59.114[.]253 | Shares service with 213.145.86[.]112 | Medium | 2026-05-11 |
| mygreatmarket[.]org | 45.59.114[.]253 resolved to domain | Medium | 2026-02-16 |
| 192.142.52[.]31 | Hosting the C2 panel | High | 2026-07-02 |
| 31.57.35[.]228 | Hosting the C2 panel | High | 2026-06-12 |