Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight

Reported facts: Anthropic disclosed that a Russian state-sponsored threat group (GTG-20006), aligned with broader Midnight reporting, used Claude in an AI-assisted workflow to rapidly rebuild malware after detection and to stay ahead of traditional security controls. The campaign demonstrates operationalized use of a general-purpose LLM as part of a cyber espionage tooling pipeline. RealGround analysis: This is a clear example of malicious AI use, where an LLM is integrated into adversary workflows to increase speed, adaptability, and evasion, raising the bar for defenders. Organizations should treat LLMs as dual-use infrastructure, implement continuous AI red teaming and secure agent design to detect and constrain similar misuse patterns, and update threat models to account for state actors weaponizing commercial AI services.