Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Summary: Anthropic disclosed that it disrupted a campaign by a Russian state-sponsored group it calls GTG-20006, linked to Midnight Blizzard (APT29), which used Claude to build an AI-assisted workflow that automatically rebuilt and redeployed its malware whenever security products detected it. The actor targeted more than 20 organizations, mainly in Ukraine and Europe, including government ministries, defense and intelligence bodies, embassies, think tanks, and defense-industrial companies, and also compromised at least three hotel guest Wi-Fi vendors to hijack DNS records.
Bottom line: Anthropic's own conclusion is that AI has inverted the cost back onto defenders: a new detection used to slow an attacker's tempo, and now it triggers an autonomous rebuild that defeats the static detection itself. The same actor exfiltrated over 300,000 national identity records and commercial registry data on more than half a million companies from a North African government technology authority.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026