Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
Anthropic's threat report covering December 2025 to August 2026 attributes the campaign to Midnight Blizzard (APT29/Cozy Bear, Storm-2945), which it links to Russia's SVR. The group compromised hotel Wi-Fi providers, altered DNS records to redirect travelers, accessed mailboxes at two drone-component manufacturers, and stole a proprietary SDK for a drone vision system, which it reverse-engineered using Claude. The group also used Claude to monitor whether security products detected its implants and to modify and redeploy flagged artifacts. The report also covers ShinyHunters affiliates using AI for credential scanning and extortion, a Chinese-speaking group's autonomous zero-day research, and a French-speaking hacktivist.
- APT29 (Midnight Blizzard) compromised hotel Wi-Fi providers and altered DNS records to redirect travelers.
- Spies stole a drone vision SDK from a military drone maker after accessing manufacturer mailboxes.
- Hackers used Claude to reverse-engineer the drone vision system and to evade security detections.
- ShinyHunters affiliates used AI to scan credentials and escalate from stolen token to admin in ~3 hours.
- A Chinese-speaking group ran autonomous vulnerability research finding zero-days in a major security product.
- ATT&CK
- T1114.002 Remote Email CollectionT1528 Steal Application Access TokenT1584.002 DNS ServerT1557 Adversary-in-the-MiddleT1567 Exfiltration Over Web Service
- Threat actors
- Midnight BlizzardAPT29Storm-2945ShinyHunters
- AI models
- Claude
From the original article
4 min read at therecord.mediaAnthropic detected and disrupted a Russia-linked cyber-espionage group that used its AI tool Claude in a hacking campaign targeting more than 20 government, intelligence, diplomatic and defense organizations.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.