- Russian state-sponsored group GTG-20006 (Midnight Blizzard) abused Anthropic’s Claude AI to automate malware rebuilding and evade security defenses.
- The AI-driven workflow enabled automatic detection of deployed malware, followed by autonomous modification to bypass static security tools.
- Attacks targeted over 20 organizations, including government ministries, defense bodies, and embassies in Ukraine, Europe, the Middle East, and Asia.
- The operation also used AI for phishing infrastructure setup, DNS hijacking via compromised hotel Wi-Fi, and monitoring of command-and-control channels.
Anthropic on Thursday revealed it disrupted a campaign by Russian state-sponsored threat actor GTG-20006, which abused the company’s Claude AI to develop a fully automated cyber espionage workflow. The group, aligned with Midnight Blizzard (APT29), targeted military intelligence, diplomatic, and defense organizations in Ukrainian and European governments, as well as individuals connected to U.S. foreign policy.
The actor built an AI-driven process that automatically rebuilt and redeployed its toolkit whenever security products detected it. “If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections,” Anthropic explained. This inverted the cost onto defenders, who previously could slow attackers by deploying new detections.
Beyond malware, the group used AI workflows to register domains, set up phishing hosting, and monitor command-and-control channels. Over 20 distinct organizations were singled out, including government ministries, defense bodies, embassies, think tanks, and defense-industrial companies, mainly in Ukraine and Europe, with extensions to the Middle East and maritime agencies in Asia. These efforts overlap with a campaign dubbed CaptiveCrunch documented by ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.
The actor compromised at least three hospitality vendors operating hotel guest Wi-Fi by using stolen admin credentials to perform DNS hijacking. Guests connecting to the hotel Wi-Fi had their traffic, device identifier, and IP address sent to the actor’s servers, where victims received ClickFix-style lures delivering Windows, Android, and iOS malware. The threat actor also exploited authorization flaws in camera streaming services to harvest tokens and access live video feeds.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Nvidia stock to surge as Yotta orders 40,000 Vera Rubin GPUs
- Blockstream Refuses Ransom for 598.5 BTC Still Held After Liquid Hack
- Zcash Bucks Weekly Downtrend Among Crypto Majors
- Apple Delists Pump Fun App in US, India Amid New Tokenized Stock Pairs
- India: BRICS Pay aims for sovereignty, not de-dollarization
