Threat actor

APT29

4 mentions in 7 days · 7 in 30 days · 8 total · first seen Aug 11, 2026 · last 4d ago

Timeline8 articles

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 14:29 UTC · 4d agoThreat actor in the wild 11 sources1

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.

Anthropic attributed the campaign to GTG-20006, aligned with Midnight Blizzard (APT29/Cozy Bear), which developed an AI-driven process that monitors its implants against security products and autonomously rebuilds and redeploys detected malware. Targets included military intelligence, diplomatic, and defense organizations in Ukraine and Europe, plus Middle East and Asian maritime agencies; the actor compromised at least three hotel Wi-Fi vendors via DNS hijacking and served ClickFix lures delivering Windows, Android, and iOS malware such as PowerChrome, GiftDrop, and DarkSword. Operations also included a North African breach exfiltrating over 300,000 national identity records and 500,000-plus company registry entries, an Embassy Kit device-code phishing campaign stealing Microsoft 365 tokens from at least eight organizations, and WhatsApp account takeover using headless browsers. The campaign overlaps with CaptiveCrunch reporting from ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.

The Hacker Newsupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 14:10 UTC · 4d agoThreat actor in the wild 11 sources2

Anthropic caught Russia-linked spies using Claude in hacking operations

Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.

Anthropic's threat report covering December 2025 to August 2026 attributes the campaign to Midnight Blizzard (APT29/Cozy Bear, Storm-2945), which it links to Russia's SVR. The group compromised hotel Wi-Fi providers, altered DNS records to redirect travelers, accessed mailboxes at two drone-component manufacturers, and stole a proprietary SDK for a drone vision system, which it reverse-engineered using Claude. The group also used Claude to monitor whether security products detected its implants and to modify and redeploy flagged artifacts. The report also covers ShinyHunters affiliates using AI for credential scanning and extortion, a Chinese-speaking group's autonomous zero-day research, and a French-speaking hacktivist.

The Recordupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 12:45 UTC · 4d agoThreat actor in the wild 11 sources

Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research

Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.

Anthropic's latest threat intelligence report covers misuse of Claude Haiku, Sonnet, and Opus models across seven harm areas between December 2025 and August 2026. Russia's SVR espionage unit GTG-20006 (APT29/Midnight Blizzard/Cozy Bear) used AI to automate its full attack kill chain against more than 20 organizations across Ukraine, Europe, the Middle East, Asia, and North Africa. A ShinyHunters-linked supply-chain affiliate breached a SaaS provider and dumped over 2,100 Azure AD token sets spanning 40+ corporate tenants in about 34 hours, with AI agents performing nearly all the work. The report also documents five biological misuse cases (chikungunya, H5 avian influenza) and six conventional weapons development cases in China, Russia, and Yemen.

The Register · Securityupdated Sep 12, 10:30 UTC · 3d agofirst Sep 10, 22:38 UTC · 5d agoAI safety & security in the wild 11 sources

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.

The Hacker NewsAug 21, 14:54 UTC · 25d agoThreat actor in the wild

Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics

Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.

Google's Threat Intelligence Group documented three suspected Russia-linked clusters, UNC6293, UNC7005, and UNC5976, abusing legitimate authentication flows. UNC6293, a likely APT29/ICE RELIC sub-cluster, impersonates US State Department officials in app password and OAuth phishing targeting fewer than five victims at a time. UNC7005, tracked by Microsoft as STORM-2945, spoofs the GLOBSEC conference, runs device code phishing against Microsoft and WhatsApp accounts, and deploys VIDAR and AtomicStealer infostealers. Targets include researchers, academics, diplomats, think-tank analysts, and defense personnel in Europe and the United States.

Security AffairsAug 21, 11:11 UTC · 25d agoThreat actor in the wild1

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security AffairsAug 21, 09:14 UTC · 25d agoExploit / PoC in the wildCVE-2026-73570

CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.

Zscaler ThreatLabz analyzed the CaptiveCrunch credential theft campaign first reported by Microsoft on July 31. Microsoft attributes the activity to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard (APT29, Cozy Bear, NOBELIUM, BlueBravo). The actor manipulates DNS and HTTP traffic on captive portal networks at hotels and conference centers, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery. Evidence indicates shared captive portal services were compromised rather than each venue being breached individually.

Zscaler ThreatLabzAug 11, 22:06 UTC · Aug 11, 2026Threat actor in the wild

Related CVEsby mentions

CVE-2026-735708.932%
Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.
· Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20 (when the optional zimbra-snmp package is installed and SNMP notifications are enabled) KEV PoC ×4large

Appears with

threat actor Midnight Blizzard 6 threat actor Storm-2945 4 vendor Anthropic 4 vendor Microsoft 4 product Claude 3 product WhatsApp 3 threat actor ShinyHunters 3 threat actor GTG-20006 3 organization Anthropic 3 ai model Claude 3 product Microsoft 365 3 threat actor Cozy Bear 2 threat actor UNC7005 2 threat actor UNC5976 2 threat actor UNC6293 2 organization Google Threat Intelligence Group 2

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.