Threat actor

GTG-50021

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 11, 2026 · last 4d ago

Timeline2 articles

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 14:29 UTC · 4d agoThreat actor in the wild 11 sources1

Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.

Anthropic's threat intelligence report documents the Russian state-nexus actor Midnight Blizzard using Claude to automatically monitor, modify, and redeploy malware until it evaded security products. The campaign hit more than 20 organizations, including Ukrainian and European government ministries, defense bodies, embassies, and think tanks, with mailbox theft from two drone component manufacturers and compromise of hotel guest Wi-Fi via DNS hijacking. The report also describes financially motivated groups GTG-50020 and GTG-50021 targeting AI credentials, including a prompt-injection attack on an automated evaluation sandbox that yielded production API keys and attempts to reach a pre-release Claude model across roughly 30 AI companies.

SecurityWeekupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 08:47 UTC · 4d agoThreat actor in the wild 11 sources4

Appears with

threat actor Midnight Blizzard 2 product Claude 2 ai model Claude 2 vendor Anthropic 2 threat actor GTG-50020 2 threat actor ShinyHunters 1 malware CaptiveCrunch 1 organization Anthropic 1 product AWS EC2 1 product TruffleHog 1 threat actor APT29 1 vendor Microsoft 1 threat actor GTG-10007 1 threat actor GTG-20006 1 threat actor GTG-50014 1 threat actor GTG-50029 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.