Claude AI Used by Midnight Blizzard to Automate Cyber Attacks

Anthropic reports state actors used Claude AI to automate cyber intrusions and malware rebuilding targeting Ukraine and Europe.

Anthropic's September 2026 threat report states that suspected state-backed groups, criminals, and hacktivists used Claude models to automate phishing infrastructure, credential theft, command-and-control, and malware evasion in real intrusions from December 2025 to August 2026. GTG-20006, assessed as consistent with Midnight Blizzard, targeted Ukrainian and European government, military, diplomatic, and defense organizations including drone suppliers. Separately, suspected ShinyHunters affiliates scanned 1.8 million Android packages for secrets and dumped more than 2,100 Azure AD token sets across over 40 tenants in about 34 hours, with Anthropic banning related accounts and noting no compromise to their systems. Microsoft and ReversingLabs tracked Midnight Blizzard's ChocoShell and CornFlake malware, which the operators rebuilt using Claude; ReversingLabs mapped five additional stagers between July 9 and August 3 plus two shortcut lures and a staging server still delivering files on October 5 against more than 20 organizations. Anthropic attributed Claude use to monitoring detections and redeploying implants, but ReversingLabs could not independently prove AI authorship or attribution. CSO Online analysis adds that AI-rebuilt backdoors kept the same detectable behavior across variants, with behavior and infrastructure indicators still enabling tracking despite code changes.

• Anthropic September 2026 threat report details Claude agents (Haiku, Sonnet, Opus) automating intrusion stages Dec 2025-Aug 2026
• GTG-20006 consistent with Midnight Blizzard targeting Ukrainian and European government, military, diplomatic, and defense organizations
• Suspected ShinyHunters affiliates scanned 1.8 million Android packages for secrets and dumped >2,100 Azure AD token sets across >40 tenants in ~34 hours
• Microsoft links ChocoShell PowerShell stager and CornFlake Go backdoor to Midnight Blizzard subgroup Storm-2945
• ReversingLabs mapped five additional stagers (July 9-Aug 3), two shortcut lures, and staging server active Oct 5 against >20 organizations
• Operator used Claude to rebuild and redeploy detected implants; shared infrastructure and behavior survived hash changes
• Staging server still served malware on October 5; behavior and infrastructure links enabled detection
• Anthropic banned accounts; customer API-key thefts did not compromise their systems