Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

A Russian state-sponsored threat actor has been using Claude to rebuild malware after it has been detected. This campaign, attributed to a cyber espionage group known as GTG-20006, utilized an AI-assisted workflow to evade detection. The group GTG-20006 is also referred to as part of a cluster linked to Midnight. Anthropic disrupted the campaign, which was used to develop and refine malware. The threat actor's use of AI-assisted workflows allowed them to adapt and stay ahead of detection efforts. The campaign is an example of a generative threat group using advanced techniques for cyber espionage.