Anthropic September threat intelligence report: AI means attackers no longer need to be sophisticated, as Claude is used for Russian espionage and mass data extortion

The report makes two core judgements. The first is that sophistication is no longer a barrier. In Anthropic words, the cybersecurity skills of AI models mean AI has collapsed the labour and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators. The evidence offered is that three very different classes of actor - a hacktivist using stolen API keys, disparate financially motivated individuals, and a state espionage operator - each sustained multi-victim campaigns that, even just a year ago, would have required many skilled operators and specialist knowledge. For threat intelligence investigators, that means sophistication has stopped being a reliable signal of who is behind an operation. The second judgement is that AI role in cyber operations has shifted from assistant to orchestrator. In most operations, Anthropic says, AI was not used as a question-and-answer chatbot but through multi-agent frameworks executing reconnaissance, exploitation and data exfiltration, with humans in the loop reduced to setting the targets and reviewing exfiltration. Anthropic also notes that an operating model for autonomous attacks it documented in November 2025 as used by a suspected state-sponsored campaign has now proliferated across every class of actor it investigated, and that publicly available offensive agent frameworks reproduce much of that scaffolding for anyone who downloads them.

The first deep case is GTG-20006, with GTG being Anthropic internal designator for actors observed abusing AI - Generative Threat Groups. Anthropic says its attribution is consistent with public reporting linking the actor to Midnight Blizzard, and that one of the operators is a Russian speaker using the handle JackPoterz whose tradecraft and targeting are consistent with Russian state-nexus espionage. The targets included military intelligence targets in Ukrainian and European governments, plus diplomatic and defence organisations and individuals connected to US foreign policy. Anthropic identified more than 20 distinct organisations in the actor operational planning, reconnaissance and live operations, spanning government ministries, defence and intelligence bodies, embassies and diplomatic missions, think tanks and defence-industrial companies, concentrated in Ukraine and Europe and extending to the Middle East and maritime-related government agencies in Asia; a recurring theme was Ukraine and military drone technology providers and supply chains. On method, the actor automated much of its operations through customised AI-driven workflows, from tool development, infrastructure acquisition, phishing and persistence through command and control to data exfiltration. It employed a custom toolkit of two families of Windows implants, a mobile exploitation kit, a credential stealing tool targeting browser password stores, a phishing platform mimicking priority targets such as government organisations, and an administrative console for managing compromised accounts - each re-tooled as needed through AI-assisted workflows.

Two closed loops in this case deserve more attention. The first is automated evasion: the actor used AI to monitor how well its tools evaded known security defences, and when the monitoring agents identified that deployed malware had been detected by a security product, the agents autonomously modified and rebuilt the malware to evade the existing detections, iterating until it was undetected before staging the tools on disposable hosting servers for live operations. Anthropic judgement on this is direct - AI has inverted the cost back onto defenders. Where defenders could once slow an attacker tempo by shipping a new detection, capable adversaries can now, at least in theory, close the loop faster than defenders can develop and deploy detections. The second is lateral expansion of the attack surface. To reach targets indirectly, the actor compromised at least three hospitality vendors that operate hotel guest WiFi, using stolen admin credentials to modify DNS records so they pointed to services the actor owned - a technique known as DNS hijacking. Guests on those hotel networks had their traffic, device identifier and IP address sent to the actor servers, after which ClickFix-style lures staged Windows, Android and iOS malware. Anthropic notes that Microsoft Threat Intelligence published a July 2026 report on this method of theft and delivery, which it called CaptiveCrunch. The actor also took over victims WhatsApp accounts using a platform of headless browsers, configured to suppress read receipts so victims would not notice while it bulk-exported Russian and Ukrainian language conversations, targeting at least two former high-level Ukrainian officials; it also exploited authorization flaws in the application interface of camera streaming services to enumerate users and harvest tokens granting access to live camera feeds. In an intrusion into a North African government technology authority, it stole VPN appliance credentials and took over the organisation central account server, exfiltrating its full credential database - more than 300,000 national identity records and the commercial registry data of more than half a million companies operating in the country.

The second cluster of cases, GTG-50014, is a different animal entirely - opportunistic smash-and-grab crime. Anthropic describes these actors as historically relying on broad scanning to find unpatched internet-facing systems and then exploiting them, and says AI has increased the scale and severity of that pre-existing criminal ecosystem: diverse target environments become trivial to understand and adjust to, and unique, obscure configurations become clear and exploitable. The line in the report is blunt - security through obscurity is no longer viable in this new AI-assisted world. Several clusters it identified and disrupted are suspected to be affiliates of the ShinyHunters collective - disparate in appearance and operating with their own tooling and workflows, but, by analysis of their approaches and objectives, part of the same overall operation. One French-speaking operator using the aliases MeowSHA, frkoo and blazespider ran a distributed credential-harvesting pipeline across a fleet of ten AWS EC2 workers: it mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them and scanned for hardcoded secrets with TruffleHog, routing verified findings in real time to a Telegram group organised into more than 100 source types, while a parallel GitHub organisation email harvester produced a second stream of stolen GitHub Personal Access Tokens. Those two pipelines supplied the initial-access credentials for the bulk of the confirmed breaches. The report also notes that operational security discipline by the operators was mixed - this one exposed its own EC2 staging IP, multiple Telegram bot tokens, a Squid proxy with hardcoded credentials and at least one public paste-site upload inside a victim environment; the operators also registered a domain impersonating the French national police, though Anthropic believes it served as branding for a criminal storefront rather than a phishing lure, with a subdomain acting as the web frontend for a carding autoshop selling stolen payment-card records. The report includes an IOC list for these cases as well.