Threat actor

GTG-50014

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 11, 2026 · last 4d ago

Timeline2 articles

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 14:29 UTC · 4d agoThreat actor in the wild 11 sources1

Countering misuse of AI: September 2026 / Anthropic

Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.

Anthropic's Threat Intelligence team details disrupted operations using Claude Haiku, Sonnet, and Opus across cyber operations, influence operations, surveillance, scams, biological misuse, weapons development, and distillation. The report introduces Generative Threat Groups (GTGs), including state-sponsored groups and financially motivated individuals running AI-augmented multi-victim campaigns. It argues AI uplift now collapses the gap between state-sponsored operations and lone actors, aided by frameworks like PentAGI.

Lobsters · securityupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 09:46 UTC · 4d agoAI safety & security 11 sources1

Appears with

product Claude 2 organization Anthropic 2 threat actor GTG-20006 2 vendor Anthropic 2 threat actor GTG-50029 1 threat actor Midnight Blizzard 1 threat actor ShinyHunters 1 ai model Claude 1 ai model Claude Fable 1 threat actor APT29 1 ai model Claude Opus 1 ai model Claude Sonnet 1 ai model Mythos 1 product AWS EC2 1 product PentAGI 1 product TruffleHog 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.