- A Russian hacking group used AI to rewrite malware until security software stopped catching it.
- The AI kept rebuilding and testing the code until it slipped past detection.
- The group targeted more than 20 government and defense organizations, mostly in Ukraine and Europe.
- It broke into hotel wifi networks to plant malware on guests' phones and laptops.
- Stolen data included drone software and over 300,000 national ID records from one government.
Anthropic says a Russian state hacking group used Claude to rewrite its malware until security software stopped catching it. The group matches public reporting linking it to Midnight Blizzard, a Russian crew tied to Russia's spy service. Anthropic says AI ran most of the attacks, but people picked the targets and checked stolen data. Anthropic says it cut off the group's access once it found the activity.
Anthropic GTG-20006 threat report
When security software caught one of the group's tools, an AI agent rewrote the code and tested it again. It kept doing that until the tool slipped past detection, then the group put it back to work. Anthropic says this shifts the advantage to attackers, since a new security update no longer slows them down for long.
Anthropic says the group targeted more than 20 organizations, mostly government ministries, defense agencies, embassies and think tanks in Ukraine and Europe. It also went after military drone makers. The group copied entire mailboxes from two drone parts makers and stole a full copy of one drone's camera software.
To reach some targets, the group broke into at least three companies that run hotel guest wifi and rerouted guests' internet traffic to its own servers. Guests who joined the affected wifi networks had their device details and traffic sent to the attackers. The group then used fake update prompts to trick guests into installing malware on their Windows computers, Android phones or iPhones.
Microsoft published a report in July on the same technique, calling it CaptiveCrunch and tracing it to a group it calls Storm-2945. Microsoft says Storm-2945 is linked to Midnight Blizzard, the Russian crew the US and UK governments tie to Russia's foreign intelligence service. Microsoft says the attacks hit hotel networks around the world.
Microsoft CaptiveCrunch report
The group also hijacked some victims' WhatsApp accounts and turned off read receipts to hide the theft. At least two former senior Ukrainian officials were targeted this way. In a separate break-in, the group used stolen VPN credentials to take over a North African government's central account system. That let it copy out more than 300,000 national ID records and data on over half a million companies.
