Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

Summary

Anthropic has disrupted a cyberespionage operation linked to the Russian state-nexus group Midnight Blizzard, which used Claude AI to automate malware evasion. The attackers targeted over 20 organizations, including government ministries and defense bodies, and also exfiltrated sensitive data and stole a proprietary software development kit. The report also highlights a growing trend of threat actors targeting AI infrastructure itself, such as by stealing API keys and attempting to gain access to pre-release AI models.

Full text

Anthropic disrupted a cyberespionage operation whose tradecraft and targeting match the Russian state-nexus group tracked as Midnight Blizzard, the company said in a threat intelligence report published this week. The report covers activity the company identified and shut down between December 2025 and August 2026. According to Anthropic, Midnight Blizzard used Claude to monitor how well its malware evaded detection by security products. When a tool was flagged, AI agents automatically modified and rebuilt it, then redeployed it, repeating the process until the malware went undetected again. Anthropic said this shifts the cost of the detection-evasion cycle back onto defenders. Historically, new detection signatures forced attackers into a slower, manual cycle of rewriting tools. The company said AI now lets capable actors “close the loop” faster than defenders can respond. The Russia-linked hackers targeted more than 20 organizations, according to the report. Victims included Ukrainian and European government ministries, defense and intelligence bodies, embassies, and think tanks, with additional targeting extending to the Middle East and Asia. Anthropic noted that the actor exfiltrated mailboxes from two drone component manufacturers and stole a complete proprietary software development kit for a drone vision system. The attacker spent several days reverse-engineering its architecture, hardware bill of materials, and supplier dependencies.Advertisement. Scroll to continue reading. The group also compromised at least three hospitality vendors that operate hotel guest Wi-Fi, using stolen admin credentials to redirect guest traffic through DNS hijacking. Microsoft separately documented this delivery method in July under the name CaptiveCrunch and linked it to Midnight Blizzard. Anthropic said the same actor took over victims’ WhatsApp accounts by linking them as companion devices through headless browsers, suppressing read receipts to export conversations undetected. At least two former high-level Ukrainian officials were targeted this way. Anthropic said it disrupted the activity, used what it learned to strengthen its AI safeguards, and shared intelligence with authorities and industry partners where appropriate. AI infrastructure as a target Beyond espionage, Anthropic’s report describes a separate, growing trend: threat actors are not only abusing AI as a tool to achieve their goals, but also targeting AI credentials and infrastructure. One group, tracked as GTG-50021, ran a fraudulent Claude reseller service that silently proxied paying customers to a different model while a bundled client application harvested their Anthropic account credentials for resale, the report said. A more direct case involved GTG-50020, a financially motivated Russian-speaking group that had previously targeted hotel-booking and fintech platforms. According to Anthropic, the actor used prompt injection against an AI vendor’s own automated evaluation sandbox, causing it to hand over production API keys belonging to multiple providers. The hacker then used those stolen keys to continue its attacks and, separately, launched a campaign against roughly 30 AI companies over several days. Anthropic said the actor’s explicit goal, pursued through more than a dozen attempted avenues, was gaining access to a pre-release Claude model. However, none of the attempts succeeded. Anthropic said attackers can leverage stolen AI credentials for resale value, free compute for their own operations, and cover, since the resulting activity is attributed to the legitimate keyholder. The company said organizations should treat AI API keys and agent integrations with the same scrutiny as production credentials. The cyber operations findings are part of a broader report spanning seven categories of misuse Anthropic has disrupted, including influence operations, surveillance, and biological and conventional weapons misuse. The company noted the latter connects to separate Frontier Red Team research it published on AI models’ capabilities for intelligence targeting and conventional weapons development. Related: Widened Scan Turns Up Fourth Rogue Claude Cyber Incident Related: AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns Related: US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Widened Scan Turns Up Fourth Rogue Claude Cyber IncidentOrganizations Warned of Cisco Secure FMC ExploitationRockwell Automation Patches Over a Dozen Vulnerabilities Across ProductsAnthropic Details Response to Security Incidents, Unveils Enterprise SafeguardsOpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-DaysSonicWall Warns of Two SMA1000 Zero-Days Exploited in AttacksExperiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of DollarsCritical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild Latest News Surfshark Systems Targeted by HackersPaperCut Flaws Exploited in AI-Powered AttacksMandiant Founder Kevin Mandia Joins Amazon BoardCybersecurity M&A Roundup: 33 Deals Announced in August 2026Anthropic Researcher Resigns With Warning About the Dangers of AI DevelopmentHacker Conversations: Vinnie Liu, Performer Turned RingmasterDeceptive Android Apps Exploit Google Play Early Access to Evade ReviewsWebinar Today: Keep Pace With AI – A New Operating Model for Endpoint Remediation Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveAmazon has elected Kevin Mandia to its Board of Directors.Gigamon has named Grant Yacomeni as Chief Information Security Officer.SSH Communications Security has appointed Lars Bell as Chief Executive Officer.More People On The MoveExpert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk

Indicators of Compromise

• mitre_attack — T1071.001
• mitre_attack — T1110.004
• mitre_attack — T1598.003
• mitre_attack — T1041
• mitre_attack — T1071.004

Entities