Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
-
Anthropic has disclosed that it disrupted a campaign by a Russian state-sponsored threat actor that abused Claude to build an AI-assisted workflow aimed at staying ahead of detection efforts.
The operation is attributed to a cyber espionage cluster Anthropic tracks as GTG-20006, where "GTG" stands for Generative Threat Group. According to the company, this cluster aligns with broader reporting that links it to Midnight — the article does not provide further details on that attribution.
The key takeaway from the disclosure is the tradecraft: rather than a one-off use of AI to generate code, the actor reportedly used Claude within a repeatable workflow to rebuild malware after it was detected. That pattern points to AI being folded into the post-detection phase of an intrusion, shortening the cycle between compromise, discovery, and retooling.
Anthropic said it disrupted the activity, though the source material does not detail the specific technical measures taken or the full scope of the targeting.
For defenders, the case reinforces that AI-assisted development is now part of the threat model for state-linked espionage, not just criminal opportunism. Detection and response timelines that assume slow adversary retooling may no longer hold.
Source: The Hacker News
Does your organization factor AI-assisted adversary retooling into its detection and response planning?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login