An AI agent detected the infection, modified the malware, and deployed it. The iteration process was repeated until the alerts ceased.
The Anthropic disclosure was released recently as part of a threat intelligence report detailing attacks that have been disrupted between December 2025 and August 2026. The attribution is consistent with publicly reported attribution of the attacker to Midnight Blizzard, the espionage campaign associated with Russia’s foreign intelligence agency.
Who is GTG-20006? GTG-20006 is the designation of the Russian-speaking espionage actor that used Claude to automate its attacks. The attribution by Anthropic is consistent with the public attribution of Midnight Blizzard (APT29).
The Old Price of Getting Caught
Espionage teams have been operating cyclically for some time. They craft their own set of tools and use them until the defender writes signatures against them and then start working on building another.
The cycle wastes developer resources. This was among the few levers that the defender had to place pressure on the well-funded adversary. Anthropic suggests that this is what is threatened by the AI technology.
An Agent That Treats Every Alert as Feedback
GTG-20006 ran AI agents whose job was to watch its own malware in the field. They tracked how well each tool evaded security products. When a deployed sample was detected, the agents modified and rebuilt it on their own. Their design was to keep iterating until the toolkit went undetected.
Clean builds were then staged on disposable hosting servers. Victims reached them through phishing, ClickFix lures and DNS hijacking. Inside on-premises networks, a similar loop covered implants already running: once flagged, those artifacts were identified, altered and redeployed.
The toolkit behind this loop was broad. Its Windows malware included PowerChrome, WUEngine, Shadow C2, MiniPlasma and CloudSyncSvc. Mobile targets faced GiftDrop, a rebranded Android surveillance RAT, and DarkSword, an iOS exploit chain. A browser credential stealer, a government-themed phishing platform and an account management console completed the set.
Anthropic puts the consequence plainly. Capable adversaries can, at least in theory, “close the loop” faster than defenders ship new detections.
They Also Stopped New Signatures From Arriving
One thing that should be highlighted further is that credential stealers for Windows were delivered as a part of an apparent update trap bundled with the complete set of remote access tools, designed specifically to freeze security updates on the victim machine.
This was quite straightforward because any new signatures used for detection simply did not arrive at the affected host. When combined with the rebuild process, the attack was aimed at both sides of the detection issue.
The Group That Never Needs to Rush
| Signature Detection | Trust-Based Execution Control | |
|---|---|---|
| Question asked | “Does this code look malicious?” | “Is this code trusted?” |
| Rebuilt malware, new hash | Can pass as never seen before | Still unknown, still restricted |
| Needs fresh signature updates | Yes | No |
| Result when it misses | Unrestricted execution, often silent | Restricted execution, with a record of what was blocked |
| Role | Visibility, investigation, response | Enforcement and proof of control |
Hotel WiFi, WhatsApp and Drone Blueprints
More than 20 different organizations were involved in the planning, reconnaissance, and execution phases of the attack by Anthropic. They ranged from ministries, embassies, defense and intelligence agencies, research institutions, and defense industry manufacturers. Ukraine and military drone components were their common denominator.
The methods were not always direct. The attacker compromised at least three hotels responsible for providing guest WiFi services, and used the administrative credentials for changing DNS settings to deliver ClickFix campaigns targeting guests with malware on Windows, Android and iOS platforms.
In other cases, the attacks were simple exfiltrations. The group exfiltrated large volumes of emails from at least two companies producing drone components, as well as a whole set of tools for developing vision capabilities of drones. WhatsApp accounts were hijacked using read receipt disabling features and conversations exported. At least eight different organizations were victims of the device code phishing platform that allowed mail exfiltration from a national prosecutor’s office.
We covered another Russian state operation designed to stay out of defenders’ sight in HOOKEDGE: APT28 Hides C2 Traffic Inside Microsoft Edge.
Humans Picked Targets, Agents Did the Labor
AI conducted reconnaissance and created the phishing framework. At the instructions of the operators, AI performed elements of the operations, execution of commands, credential harvesting, and lateral movement. AI then consolidated hundreds of gigabytes of the harvested information. The scheduled tasks refreshed the stolen access tokens and harvested cloud storage without any human intervention.
In the meanwhile, the operators primarily polished the skill set of Claude Code which enabled the above-described operations. The operators selected the targets.
None of the techniques used individually is new, an observation made by Anthropic for each operation described in the report. However, the cost of labor decreased. Operations requiring a group of operators can now be done simultaneously in a matter of minutes.
Detection Became the Attacker’s Test Suite
Each signature engine and behavioral classifier provides an answer to whether code is malicious. This question forms the basis of the GTG-20006 workflow. Detection is the trigger for an analysis, which is the next action taken.
The above statement explains one limitation of classification. An altered version of the code will not be recognized by any database of hashes and will produce no logs and alerts. It may be executed with unlimited privileges without leaving any traces.
Execution Governance is about asking whether code is trusted. Freshly generated code lacks a trust score regardless of the result of the scan. Enforcement based on trust assessment does not require any signature updates to be available to the host computer and to the attacker.
The implants from the toolkit in question executed on Windows systems utilize Kernel API Virtualization. File system operations, registry writes, and DCOM/RPC connections are virtualized, and network connections are prevented. Any malware rewritten changes the hash value but not the trust score of the code.
Conclusion: Detection Became the Attacker’s Feedback Loop
GTG-20006 shows how AI can change the economics of malware evasion without changing the underlying objective. When deployed implants were detected, the actor used AI-assisted workflows to identify the flagged artifacts, modify them, rebuild them, and redeploy the resulting versions. What once imposed development time and operational friction on an attacker can now become an automated iteration cycle.
That does not make detection obsolete. Behavioral telemetry, identity signals, endpoint activity, and threat intelligence remain essential for finding and investigating intrusions. The problem is relying on recognition alone as the final security decision. If every newly generated sample receives normal execution rights until a detector has learned what it is, faster malware regeneration gives the attacker repeated opportunities to search for a version that passes existing classifications.
The broader campaign reinforces the same lesson. GTG-20006 combined malware with device-code phishing, credential theft, ClickFix delivery, compromised infrastructure, cloud access, and automated data collection. AI did not replace established attack techniques. It reduced the human effort required to operate several of them simultaneously and to adapt when defenders responded.
Why This Threat Matters
- Detection can become feedback for the attacker. A blocked sample reveals that another iteration is required.
- Changing the malware can be cheaper than changing the campaign. AI-assisted rebuilding reduces the cost of producing new variants.
- A new hash does not make a new payload trustworthy. Static novelty and legitimate authorization are different questions.
- The attack crosses security layers. Endpoint malware, phishing, stolen credentials, cloud tokens, and lateral movement all appeared within the operation.
- AI amplifies operational tempo. Human operators can retain target selection while agents perform repetitive development, reconnaissance, collection, and maintenance tasks at scale.
Where Defensive Control Must Operate
Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, is the primary endpoint layer for identifying and governing malicious execution even as payloads are rebuilt and hashes change.
Execution Governance addresses the deeper problem by evaluating whether code is trusted rather than depending solely on whether a previous version was already classified as malicious.
Because device-code phishing and social-engineering delivery were also confirmed, Xcitium ITDR supports detection of abnormal identity and token activity, while Xcitium Cyber Awareness Education and Phishing Simulation address the human entry points used in the campaign.
Make Rebuilding the Malware Irrelevant
Defenders should assume that sophisticated attackers can regenerate tooling faster than traditional signature cycles can respond. The objective is therefore not only to recognize the next variant, but to prevent newly generated, untrusted code from receiving normal execution privileges while preserving the endpoint and identity evidence needed to investigate the intrusion.
