Anthropic Says Russian State Hackers Used Claude to Automate Malware Evasion

Anthropic says it disrupted a Russian state-linked espionage operation that used Claude to run its own malware through an automated evasion loop: test the tool against security software, rewrite whatever gets flagged, and redeploy, over and over, without a human rewriting a line of code. SecurityWeek first reported the disclosure, which is part of the company’s most detailed threat intelligence report to date, covering eight months of misuse across seven harm categories, from cyberattacks to biological weapons research.

A Malware Loop That Rewrites Itself

Anthropic tracks the actor internally as GTG-20006. The company says its tradecraft and targeting match Midnight Blizzard, the Russian state-nexus group that Microsoft and other researchers have also tracked under the older names APT29, Cozy Bear, and NOBELIUM, and that US and UK officials attribute to Russia’s Foreign Intelligence Service (SVR). One operator used the handle “JackPoterz.”

The campaign targeted more than 20 organizations, concentrated among Ukrainian and European government ministries, defense and intelligence bodies, embassies, and think tanks, with additional targeting reaching the Middle East, a maritime-focused government entity in Southeast Asia, and a North African government technology authority. According to Anthropic, Claude drove much of the workflow directly: researching targets, registering phishing domains, configuring hosting infrastructure, and monitoring which command-and-control channels had successfully compromised a victim.

The evasion loop is the part Anthropic emphasizes most. When a security product flagged one of the group’s Windows or mobile implants, Claude-driven agents automatically modified and rebuilt the code, then redeployed it from disposable servers, repeating the cycle until the tool evaded detection again. Anthropic named the malware families involved: PowerChrome, WUEngine, Shadow C2, MiniPlasma, and CloudSyncSvc on Windows, GiftDrop (a rebranded version of an existing Android surveillance tool) on Android, and an iOS exploit chain called DarkSword. The company argues this inverts a defensive assumption that has held for years. New detection signatures used to force attackers into a slow, manual rewrite cycle. Anthropic says AI now lets capable actors “close the loop” faster than defenders can respond, regardless of how well-resourced they are.

Drone Blueprints and Hijacked WhatsApp Accounts

Beyond the malware itself, the report describes a wider set of objectives tied to the war in Ukraine. GTG-20006 bulk-exported mailboxes from at least two drone-component manufacturers and stole a complete proprietary software development kit for a drone vision system, then spent several days using Claude to reverse-engineer the product’s architecture, hardware bill of materials, and supplier dependencies, according to Anthropic and corroborating detail from CyberScoop.

The group also compromised at least three hospitality-sector Wi-Fi providers to redirect hotel guests through hijacked DNS records, a delivery method Microsoft Threat Intelligence separately documented in July under the name CaptiveCrunch, attributing it to Storm-2945, a Midnight Blizzard sub-cluster. On top of that, GTG-20006 took over victims’ WhatsApp accounts by linking them as companion devices through headless browsers, using an open-source WhatsApp automation library to suppress read receipts while it bulk-exported conversations undetected. At least two former high-level Ukrainian officials were targeted this way. In an operation Anthropic frames as an exception to the group’s usual Ukraine-and-drones focus, the same actor also breached a North African government technology authority, stealing more than 300,000 national identity records along with commercial registry data covering more than half a million companies, per Anthropic’s report, CyberScoop, and Cyber Security News.

A Separate Target: The AI Vendors Themselves

Anthropic’s report also describes a distinct and, it says, growing trend that has nothing to do with espionage: criminals going after AI credentials and infrastructure directly, rather than just using AI as a tool. Two case studies illustrate it, and neither is linked to Midnight Blizzard.

A Reseller Scheme That Sold Neither Discount Access Nor Real Claude

A Russian- and Ukrainian-speaking group Anthropic tracks as GTG-50021, one of whose members used the alias “kl1zy,” ran a fraudulent reseller service advertising cheap access to Claude. Customers who signed up were quietly proxied to a different AI model entirely, while a bundled client application installed a credential harvester that stole their real Anthropic account logins so the group could resell that access too.

A Sandbox Break-In Aimed at an Unreleased Model

A separate, financially motivated Russian-speaking group, GTG-50020, had previously targeted hotel-booking and fintech platforms. According to Anthropic, this group used prompt injection against an AI vendor’s own automated evaluation sandbox, tricking it into handing over production API keys belonging to multiple AI providers. It used those stolen keys to keep its own attacks running at someone else’s expense, then separately ran a campaign against roughly 30 AI companies over several days. Anthropic says the group’s explicit goal, pursued through more than a dozen distinct attempts, was gaining access to a pre-release Claude model. None of the attempts succeeded. Anthropic’s own framing of the incentive is blunt: stolen AI credentials buy free compute, resale value, and cover, since the resulting activity gets attributed to whoever legitimately owns the key.

Why This Report Reads Differently Than Anthropic’s Last One

Anthropic has made claims like this before, and its track record is part of why this report is worth reading carefully rather than at face value. In November 2025, the company disclosed a separate case involving GTG-1002, an alleged Chinese state-sponsored group it said had carried out cyberespionage that was roughly 80 to 90 percent automated through Claude Code. That disclosure drew immediate, public pushback. Cybersecurity researcher Kevin Beaumont wrote on Mastodon at the time that the report’s impact was likely overstated, arguing that existing detections would probably still work against the open-source tooling involved, and that “the complete lack of IoCs again strongly suggests they don’t want to be called out over that,” according to BleepingComputer’s reporting at the time. Researcher Daniel Card was blunter, calling the report “marketing guff.”

This month’s report is a meaningful departure on that specific point. Anthropic published an extensive appendix of indicators of compromise tied to GTG-20006, including phishing domains spoofing Microsoft 365 login pages, such as ms365-live[.]com and owa-ms365[.]com, and lookalike domains built to resemble the organizations the group was targeting, alongside attacker IP addresses and the named malware families listed above. That is precisely the category of technical detail whose absence fueled the criticism of the November report. It does not settle the question of how much of this activity was genuinely autonomous versus human-directed, but it gives outside researchers something concrete to check Anthropic’s claims against.

One Case Among Several

GTG-20006 is the most developed case study, but the report documents a broader pattern across unrelated actors. It describes affiliates of the ShinyHunters extortion collective dumping roughly 2,100 stolen cloud access tokens across 40 corporate tenants in 34 hours, two Chinese undergraduates running an automated exploit foundry that produced more than a dozen potential zero-day vulnerabilities in a single month, and a lone hacktivist who sustained a monthlong campaign against European political parties using nothing but stolen API keys, according to CyberScoop’s review of the report. Anthropic’s own conclusion is that sophistication has stopped being a reliable signal of who is behind an attack, since a lone hacktivist, scattered financially motivated criminals, and a state espionage operator each ran campaigns that, a year earlier, “would have required many skilled operators and specialist knowledge.”

What Anthropic Says It Did About It

For each case in the report, Anthropic says it disrupted the activity, used what it learned to tighten its safeguards, and shared intelligence with authorities and industry partners where appropriate. The company is urging other AI developers and their customers to treat API keys and agent integrations tied to AI accounts with the same scrutiny normally reserved for production credentials, arguing that the sandboxes, proxies, and reseller arrangements customers build around AI access are now part of the attack surface, not just the models themselves.