Anthropic Says Russia-Linked Hackers Used Claude To Evade Malware Detection Across 20+ Targets

Anthropic says a Russia-linked cyberespionage actor used Claude-powered workflows to automatically modify and rebuild malware whenever security products detected it, as part of operations targeting more than 20 organizations across government, defense, intelligence and other sectors.

The AI company says the development could change the economics of cyber defense, allowing sophisticated attackers to repeatedly adapt malicious tools faster and with less manual effort.

 

TL;DR

 

• Anthropic says GTG-20006 used AI agents to detect when its malware was caught, automatically modify it and rebuild it until security tools no longer detected it.
• More than 20 organizations were targeted, including governments, intelligence bodies, embassies and defense companies.
• Anthropic linked the tradecraft to Russia-connected Midnight Blizzard activity.
• Microsoft previously documented related AI-assisted attacks under its CaptiveCrunch campaign.

 

Russia-Linked Hackers Used Claude To Rebuild Malware

 

Anthropic detailed the campaign in its https://www.anthropic.com/threat-intelligence-report-september-2026, which covers malicious activity the company identified and disrupted between December 2025 and August 2026.

The company tracks the actor as GTG-20006 and said its attribution is consistent with public reporting linking the operation to Midnight Blizzard. One operator was a Russian speaker using the handle “JackPoterz,” whose targeting and tradecraft Anthropic said were consistent with Russian state-nexus espionage.

The actor used customized AI-driven workflows across numerous stages of its operations, including malware development, infrastructure acquisition, phishing, persistence, command and control, and data exfiltration.

However, one of the most notable uses involved malware evasion.

Anthropic said AI agents monitored whether deployed malware had been detected by known security defenses. If a security product identified the malicious software, the agents would autonomously modify and rebuild it before trying again.

“The agents were designed to continue iterating on GTG-20006’s toolkit until it was undetected,” Anthropic said in the report.

The company said Claude was also used to systematically identify, modify and redeploy malicious artifacts when security products flagged implants operating inside compromised environments.

 

More Than 20 Organizations Were Targeted

 

Anthropic identified more than 20 organizations involved in the group's operational planning, reconnaissance and live attacks.

Targets included government ministries, defense and intelligence organizations, embassies, diplomatic missions, think tanks and defense-industry companies. Most of the activity was concentrated in Ukraine and Europe, although targeting also extended into the Middle East and government organizations in Asia.

According to the https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/, the operation also exfiltrated mailboxes belonging to two drone-component manufacturers and stole a proprietary software development kit for a drone vision system.

Anthropic said the actor spent several days reverse-engineering the system's architecture, hardware components and supplier dependencies.

The attackers also targeted hotel guest networks. Anthropic said at least three hospitality vendors were compromised, allowing the actor to redirect guest traffic through DNS hijacking and deliver malware to selected victims.

Microsoft Previously Tracked Related Campaign

 

Microsoft had previously documented related activity in its https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/ published in July 2026.

Microsoft tracks the operator as Storm-2945, which it assesses is an operational sub-cluster of Midnight Blizzard, the Russia-based threat actor attributed by the US and UK governments to Russia's Foreign Intelligence Service.

Microsoft said the group had been conducting AI-augmented attacks since February 2026, while its CaptiveCrunch activity involved manipulating traffic on networks using captive portals, including hospitality networks, to deliver malware and steal credentials.

The company also credited Anthropic and OpenAI for supporting its investigation.

 

AI Could Speed Up Malware Evasion

 

For defenders, the bigger concern is not simply that attackers used an AI chatbot to write malicious code.

Anthropic argues that AI can automate the feedback loop between detection and evasion.

Traditionally, once defenders developed a signature capable of identifying an attacker’s malware, the attacker had to spend additional time and resources modifying its tools. With AI agents monitoring detections and automatically rebuilding flagged malware, that process could become substantially faster.

Anthropic said this potentially “inverted the cost back onto defenders,” because capable attackers may be able to bypass traditional static detections faster than security teams can develop and deploy new ones.

The company said it banned accounts associated with the malicious activity, strengthened its safeguards and shared relevant threat intelligence with authorities and industry partners.

The incident offers another example of AI moving beyond an advisory role in cyberattacks, with agents increasingly capable of executing and orchestrating parts of an attack chain with humans setting objectives and overseeing the results.