Last seven days
- First activity
- Aug 14, 2026
- Last activity
- Aug 14, 2026
- Feed role
- C2
- Host form
- 1 IP / 0 hostnames
CornFlake
CornFlake is a Go-based Windows remote access trojan used as the primary persistent implant in the CaptiveCrunch espionage campaign attributed by Microsoft to Storm-2945, a sub-cluster of Midnight Blizzard (APT29), which Western governments have linked to Russia’s SVR.
Profile source: Mallory opens in a new tabCornFlake
Family profile
CornFlake is a Go-based Windows remote access trojan used as the primary persistent implant in the CaptiveCrunch espionage campaign attributed by Microsoft to Storm-2945, a sub-cluster of Midnight Blizzard (APT29), which Western governments have linked to Russia’s SVR. It is designed to provide long-term access to compromised Windows systems and to support credential theft, surveillance, reconnaissance, and data exfiltration against targets that appear to include corporate travelers and organizations of intelligence interest.
CornFlake has been delivered through captive-portal traffic manipulation on hospitality and conference Wi-Fi networks, where victims are redirected to fake browser or operating system update pages using ClickFix-style social engineering. During installation it displays a fake progress or update window to reduce suspicion, then establishes durable persistence through multiple mechanisms including Windows service registration, Run-key persistence, scheduled tasks, and a watchdog routine that restores removed persistence components. It masquerades as a legitimate cloud synchronization service to blend into the host environment.
The malware supports a broad post-compromise feature set. Reported capabilities include remote shell access, keylogging, clipboard monitoring, screenshot capture, microphone and webcam surveillance, browser credential theft, cookie theft, Microsoft 365 session token theft, file exfiltration, USB monitoring, and host reconnaissance. It also collects system intelligence and supports encrypted command-and-control communications using modern cryptographic key exchange. Some reporting indicates it exposes a local HTTP API that can support modular tasking and companion payloads such as ChocoShell.
Operationally, CornFlake functions as the persistence and remote-control component of a broader intrusion set that also includes ChocoShell, an in-memory PowerShell stealer, and FruitStone, a web-based management panel. The malware is associated with espionage-oriented collection rather than disruptive effects, with emphasis on maintaining access, harvesting credentials and sessions, monitoring victim activity, and extracting files and other sensitive data from Windows endpoints.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Keylogging
- Persistence
- Post Exploitation
- Reconnaissance
- Session Hijacking
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Aug 14
Observed infrastructure
Leading locations
- ES1
Leading providers
- Ultahost, Inc.1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
Reported operators
Threat actors
4 named in public reportingMicrosoft also found evidence that the group used AI tools to assist operations, including the development of the CornFlake and ChocoShell malware.
Microsoft also found evidence that the group used AI tools to assist operations, including the development of the CornFlake and ChocoShell malware.
One of the malware strains it delivers is CornFlake. Described as "a full-featured Windows RAT" written in Go, CornFlake is the SVR's go-to persistent implant in these hospitality network attacks.
One of the malware strains it delivers is CornFlake. Described as "a full-featured Windows RAT" written in Go, CornFlake is the SVR's go-to persistent implant in these hospitality network attacks.
MITRE ATT&CK
CornFlake in ATT&CK
44 distinct techniquesTechniques
44 techniques T1189 Drive-by Compromise T1123 Audio Capture T1113 Screen Capture T1071 Application Layer Protocol T1562 Impair Defenses T1547.001 Registry Run Keys / Startup Folder T1070 Indicator Removal T1557 Adversary-in-the-Middle T1204 User Execution T1219 Remote Access Tools T1125 Video Capture T1041 Exfiltration Over C2 Channel T1056.001 Keylogging T1053 Scheduled Task/Job T1070.004 File Deletion T1543.003 Windows Service T1036 Masquerading T1071.001 Web Protocols T1134 Access Token Manipulation T1555 Credentials from Password Stores T1059 Command and Scripting Interpreter T1574 Hijack Execution Flow T1082 System Information Discovery T1053.005 Scheduled Task T1115 Clipboard Data T1005 Data from Local System T1539 Steal Web Session Cookie T1566 Phishing T1547 Boot or Logon Autostart Execution T1120 Peripheral Device Discovery T1105 Ingress Tool Transfer T1565.001 Stored Data Manipulation T1025 Data from Removable Media T1556.009 Conditional Access Policies T1204.002 Malicious File T1059.003 Windows Command Shell T1497.001 System Checks T1205.001 Port Knocking T1059.001 PowerShell T1091 Replication Through Removable Media T1573 Encrypted Channel T1555.003 Credentials from Web Browsers T1083 File and Directory Discovery T1021.001 Remote Desktop Protocol
