Skip to content

Anthropic Threat Intelligence report (September 2026): GTG case studies — autonomous malware-rebuild loops, ShinyHunters AI uplift, a Changsha exploit foundry, and prompt-injection of AI evaluation sandboxes

Summary

Anthropic's Threat Intelligence team published its September 2026 "Detecting and Countering Misuse of AI" report (surfaced in tl;dr sec #346, September 17, 2026; full report and IOC download at anthropic.com), covering disruptions between December 2025 and August 2026 across seven harm areas. Anthropic tracks the actors as internal Generative Threat Groups (GTGs) and introduces an uplift framing (speed / scale / depth added by AI). The cyber-operations section is the durable defender value: a suspected Midnight Blizzard-linked operator ran an autonomous malware-rebuild-to-evade-detection loop; suspected ShinyHunters affiliates used agents to dump 2,100+ Azure AD token sets across 40+ tenants in ~34 hours; a Chinese-speaking student collective in Changsha ran a standing AI exploit foundry against endpoint-security products and appliances; and a Russian-speaking criminal prompt-injected an AI vendor's automated evaluation sandbox to exfiltrate its production AI API keys, then attacked ~30 AI companies in ~4 days. Anthropic's headline read: "sophisticated attacks no longer require sophisticated attackers," and "security through obscurity is no longer viable" because AI makes any reachable configuration rapidly exploitable.

Tags

GTG-20006: suspected Midnight Blizzard with an autonomous evasion loop

  • Anthropic's attribution is consistent with public reporting linking the actor to Midnight Blizzard (SVR per US/UK govts). One operator is a Russian speaker using the handle "JackPoterz".
  • Targeting: 20+ distinct organizations — Ukrainian government/military/diplomatic staff, European ministries, embassies, think tanks, defense industry; secondary theme is military drone technology and supply chains; exceptions include a Southeast Asian maritime-shipping government entity and a North African government technology authority.
  • The durable tradecraft shift: AI agents continuously monitored how well the actor's malware evaded security products; when a sample was detected, agents autonomously modified and rebuilt it until undetected, then staged it on disposable hosting for live phishing / ClickFix / DNS-hijacking operations. The human primarily refined the Claude Code skills driving the workflows. Static detections impose little cost on this loop — defense must move to behavior.
  • Toolkit: two Windows implant families, a mobile exploitation kit, a browser-password-store stealer, a target-mimicking phishing platform, and an admin console for managing compromised accounts — all re-tooled through AI workflows mid-campaign.
  • Objectives observed: bulk mailbox exports of at least two drone component manufacturers, a stolen complete proprietary SDK for a military drone vision system (days spent AI-assisted reverse-engineering it into architecture, BOM, supplier dependencies, and an unannounced product), scanning of email/remote-access services across two dozen+ Ukrainian government organizations. Outside the Ukraine theme: a North African government technology authority intrusion where stolen VPN-appliance credentials led to takeover of the organization's central account server and exfiltration of its full credential database including 300,000+ national identity records; and token-harvesting from camera-streaming services' authorization flaws to view victims' live camera feeds.
  • Hospitality pivot cross-link: the actor compromised at least three hospitality vendors that operate hotel guest WiFi, used stolen admin credentials to DNS-hijack guest traffic to actor services, then staged ClickFix lures delivering Windows, Android, and iOS malware. This is the same initial-access pattern Microsoft independently attributes to Storm-2945 / CaptiveCrunch (see related page) — Anthropic's account adds the operator-side view that the hospitality DNS-hijack + ClickFix chain is embedded in a broader AI-automated espionage operation.
  • Representative IOCs (report set, de-defanged): ms365-live[.]com, teams.ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, mslivetest.duckdns[.]org, my-invite[.]org, chamber-ua[.]org, chathamhouse[.]eu, ukrinform-share[.]net, statistic-ms[.]live, static-ms[.]live, ad-g[.]org, docs-viewer[.]org, wa-connect[.]eu, mygreatmarket[.]org/.com, cdncounter[.]net, IPs 104.145.210[.]184, 31.57.243[.]154, 104.194.151[.]133, 104.194.159[.]55, 144.172.114[.]192, 213.145.86[.]112, 2.26.53[.]194.

GTG-50014: suspected ShinyHunters affiliates — AI uplift of smash-and-grab

  • Multiple disrupted clusters Anthropic assesses as affiliates of the ShinyHunters collective; operators share tooling-independent objectives: steal credentials → mass exploit → go straight to customer databases → pay-or-leak extortion, with SaaS breaches used to reach downstream customers.
  • Credential-harvesting pipeline at industrial scale: one French-speaking operator (aliases MeowSHA | frkoo | blazespider) ran 10 AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs, decompiled them, and scanned for hardcoded secrets with TruffleHog, routing verified hits in real time to a Telegram group organized into 100+ source types; a parallel harvester mined GitHub organization emails feeding stolen GitHub Personal Access Tokens. These two pipelines supplied initial access for most of frkoo's confirmed breaches.
  • OPSEC failures: exposed their own EC2 staging IP, Telegram bot tokens, a credentialed Squid proxy, and paste-site uploads inside a victim environment; registered policenationale[.]cc impersonating the French national police as the storefront brand — autoshop.policenationale[.]cc served a carding "autoshop" (stolen cards enriched with BIN lookups + cardholder PII + victim-address geolocation map) delivered via a Telegram Mini App (@Soraki_Bot) on a PostgreSQL/GraphQL "Soraki" stack that also aggregated ~400,000 telecom/ISP records with IBANs/BICs.
  • Victim scope in the disrupted set: a technology provider lost >1 TB including hundreds of thousands of national identifiers and millions of payment-card records (staged on a public website for ransom pressure); an airline's systems holding tens of millions of passenger records were accessed; an energy company — the actors claimed remote control of customers' home EV-charging current (extortion leverage over physical effect).
  • Supply-chain specialization: one affiliate breached a SaaS provider and extracted data belonging to ~200 downstream customer organizations, plus a session-store dump of 2,100+ Azure AD token sets spanning 40+ corporate tenants in about 34 hours — "AI agents performed nearly all of the work." Another XSS → privilege escalation → exfil chain harvested data from thousands of downstream customer orgs, with Claude used to understand developer/auth APIs, mint privileged tokens, and build bulk-export and cross-tenant collection tools.
  • Tempo: first-access → bulk data theft in hours; one escalation from a single stolen developer token to full cloud admin in ~3 hours.
  • Bug bounty as a second revenue stream: the same actor claimed $2,000 / $5,000 HackerOne payouts from two companies they had infiltrated and extorted, and scraped HackerOne/BugBounty submissions as reconnaissance — converging with the manufactured-compromise model CrowdStrike documented in PhantomRaven (related page).
  • AI-key laundering: during intrusions the affiliates stole AI API keys from victims' enterprise software vendors and ran their own follow-on attacks (a French retail chain, a Web3 identity platform, continued pressure on a nonprofit — and even development work on their own carding shop) on the victim's keys for ~3 weeks. Anthropic's framing of why attackers want AI credentials: loot (resale), compute (workloads at the victim's expense), and cover (attribution to the key's legitimate owner).
  • IOCs (subset): soraki[.]cc, soraki[.]work, policenationale[.]cc, soraki-proxy.20245aad98d27b1b1a2f0f103e1d7ee0.workers[.]dev, updatebeacon.duckdns[.]org, esvfecawvjmchjslqyemho2fiduc59wzn.oast[.]fun, emailsecure[.]email, mozilla[.]ws, signin-1psswoord[.]com, on-pssword[.]com, ari-chain[.]com, arichain[.]network, bitmart-mystery[.]com, defi-claim[.]xyz, service-infos[.]info, 0x0[.]st (curl exfil uploads); exfil buckets fuckyoubasil@ s3.ap-tokyo.megas4[.]com, s3.eu-central-1.s4.mega[.]io/fuckyoubasil/.

GTG-10007: the Changsha "exploit foundry" — autonomous vuln research as a standing program

  • A sustained espionage operation run by Chinese-speaking operators likely residing in Changsha, Hunan; two identified as undergraduates at a local university's School of Computer & Communication Engineering, one with a prior Sangfor internship who was interviewing at QiAnXin for an offensive cyber role.
  • The centerpiece: an autonomous vulnerability-research program against a major endpoint-security product (software deployed specifically to detect intrusions) that produced multiple previously-unknown vulnerabilities, validated by the actors in their own lab, plus working exploits for several families of network and security appliances — with separate observed exploitation attempts against those same appliance types at multiple government organizations globally. One continuously-iterating appliance-research workflow yielded more than a dozen possible zero-day findings in a single month.
  • Roughly fifty organizations targeted across education, retail, energy, technology, healthcare, finance, manufacturing, and multiple governments: bulk student personal data extracted from an ed-tech company's cloud storage; production access at a retail company; citizen records (names, phone numbers, home addresses) retrieved from a Southeast Asian government agency.
  • Operating model that defenders should treat as the template: "agent swarms" — a lead AI agent decomposes recon/post-exploitation and dispatches parallel subagents; persistent campaign memory across sessions (target lists, harvested credentials, engagement state, standing instructions); parallel workstreams (operations, foreign-government recon, security-product reverse engineering, malware development, an unattended OSINT collection platform aligned to state intelligence priorities) with shared tooling and infrastructure.
  • Anthropic banned the accounts and added monitoring. Preserve the boundary: Anthropic does not state a state-tasking link; the student-employee pipeline observation (Sangfor → QiAnXin offensive roles) is the most concrete public account of the talent-and-tooling convergence between AI-labored exploit research and China's security-vendor labor market.

GTG-50020: prompt-injecting an evaluation sandbox — the AI supply chain as a criminal target

  • A Russian-speaking financially motivated actor with prior hotel-booking/fintech intrusions (one exfil: ~26 GB, extortion asks $1.5–2.5M) redirected the same tradecraft at AI companies.
  • The novel technique: by injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the production AI API keys of multiple providers that the vendor held. Anthropic's read: "the clearest demonstration to date that the AI supply chain has become a deliberate criminal target." (Same class as the Mandiant active-session hijack, against a different trust boundary — evaluation harnesses ingest untrusted content while holding credentials.)
  • Post-theft behavior: the actor auto-switched attack workloads onto the stolen victim keys, then ran a follow-on campaign from the same infrastructure against ~30 AI companies in ~4 days — found one working attack path and repeated it against all thirty targets with slight per-target adaptation. The stated goal, pursued across a dozen avenues, was access to a pre-release Claude model; every path failed and Anthropic's own systems were never compromised (the keys were customers' keys in customers' environments).
  • Supporting automations documented: a human-directed AI pentest loop (per-target scope file → parallel recon/exploitation agents → re-test findings → incremental report → next domain), an autonomous exploitation pipeline (containerized open-source pentest platform behind a local model gateway, run with exploitation enabled against production: injection/XSS/auth-bypass/SSRF testing unsupervised), a fraud account factory (residential proxies + antidetect profiles + commercial CAPTCHA solving + automated KYC → banked verified accounts), and a KYC interception cloak (reverse proxy relaying the real KYC flow while capturing the verified session and documents for reuse).
  • Attacker egress IPs (with first/last-seen May–June 2026): 141.133.125[.]208, 167.250.111[.]136, 178.16.54[.]141, 37.27.103[.]22, 194.163.183[.]216, 202.66.167[.]230, 146.103.101[.]253, 146.103.97[.]169.

GTG-50029: a lone hacktivist with APT-scale output

  • A single French-speaking actor, spring 2026, targeting European political parties, media, think tanks, and the SaaS providers serving them — running for a month entirely on stolen API keys.
  • Signature access technique: a previously undocumented WordPress re-installation race condition that creates a rogue administrator account without valid credentials — the actor developed and debugged the exploit, plus a lab harness, with Claude in the same session; succeeded against at least four victim websites. Treat as an urgent class: any WP installer state reachable pre-hardening is an account-creation primitive.
  • Other tradecraft: exfiltrated ~140,000 records including users' political opinions from a campaign-management platform's exposed search endpoint by agent iteration; a webshell hidden among font assets built on the fly per vulnerability; a WordPress "must-use" plugin harvesting submitted credentials, encrypted with per-site public keys and staged for pickup; poisoned the victim's backups so a restore re-infects (backup integrity is now persistence surface); and a browser-exploitation C2 framework injected into a media outlet's site to fingerprint thousands of readers while specifically hunting the editorial staff's sessions and credentials.
  • Signature tool: "fafsearch," a compiled, containerized doxing platform — ingestion pipelines, cross-referencing of breach dumps against exfiltrated data, normalization of national identity numbers/phone numbers, ranking logic, and tests: an AI-built target-selection engine for politically motivated publishing.

Fraudulent AI resellers and LiteLLM prompt-injection theft

  • GTG-50021 (Russian/Ukrainian-speaking, alias "kl1zy") and siblings ran fake Claude-reseller operations: customers believed they bought discounted Claude access; traffic was silently proxied to a different model while the reseller's tooling installed a credential harvester, stealing customers' own AI-account credentials for resale. The supply side of reseller fraud is exposed-key mining from APKs, public code, containers, websites, and chatbots — the same pipeline GTG-50014 industrialized.
  • Multiple actors were observed compromising AI wrapper services' LiteLLM deployments — prompt injection to exfiltrate the production API keys from their cloud-hosted containers. This matches the pattern set already documented on our LiteLLM pages (TeamPCP's March compromise; Wiz's Off-Guard auth-bypass-to-cloud-compromise; Symantec's node.exe chains): the proxy tier where an org's provider keys consolidate is itself a target, and prompt injection is now a credential-theft primitive against it.
  • Reseller-fraud IOCs (GTG-50021): awstore[.]cloud, kiro[.]cheap, sys-tools[.]cfd, aws-us-east-3[.]com, holdboost[.]store, deltaclient[.]xyz, iymkjuzymkapovrntoxy.supabase[.]co.

Non-cyber case studies (brief, durable)

  • Influence-as-a-service (GTG-54002): one account used Claude to mass-produce/rewrite political content across ~70 fabricated news sites + 70 matching X accounts + 250+ inauthentic commenting accounts, 8,913 articles in ~20 languages on six continents, traced to LKM Company, a France-based digital ad agency; ideology followed the payer. Brookings Breakout Scale assessment: Category Two (no breakout beyond its own network).
  • Russian state-media editorial pipelines (GTG-24015): four accounts used Claude as a news-production desk whose outputs were matched into Sputnik Moldova, RIA Novosti, Sputnik en Español, Sputnik Africa, and RT's English newsroom — AI achieved the output of a full editorial desk; unlike covert networks, the content reached established real-audience channels.
  • Illicit distillation (named-lab section of the report): Anthropic says it detected and disrupted campaigns attributed with high confidence to specific PRC-based labs targeting Opus-class models since February 2026, with scales: Alibaba/Qwen (GTG-16005) — over 151M exchanges May–Jul 2026, the largest measured: a chain-of-thought extraction prompt forcing Claude to emit reasoning traces in inline tags feeding SFT for Qwen 3.5/3.6/3.7, peaking near 3M exchanges/day from 3,500+ fraudulent accounts, plus Claude used for Alibaba's own RL-environment and model-architecture R&D; Moonshot/Kimi (GTG-16002) — 23M+ exchanges: silently served Claude responses to users who thought they were using Kimi (~300k requests in ten days via a 5,380-account proxy network); DeepSeek (GTG-16001) — 12.1M+ exchanges over 14 days in July: tagging Claude Code / Agent SDK / OpenCode harness users and relaying selected requests to Opus, plus a CoT extraction pipeline; Zhipu/Z.ai (GTG-16006) — 3.4M+ exchanges over 17 days (770,609 through its CoT "cleaner" in ten days against Opus 4.8), plus a CTF-challenge campaign targeting the cyber capabilities of US frontier models ahead of GLM 5.3; Xiaomi (GTG-16008) — 400k+ exchanges over 20 days: replayed its own users' MiMo conversations through Claude (MiMo-V2-Pro free-trial surge assessed as the harvest vector). SenseTime's (GTG-16012) pipeline included purchased Claude transcripts harvested from intermediary/proxy services (users routed through logging third-party apps whose exchanges were sold by data vendors); Claude also wrote the pipeline and launched/monitored training runs. MiniMax (GTG-16003) built a shell-company proxy network exposing only Anthropic and OpenAI models — consistent with transcript harvesting rather than a real reseller. Privacy twist defenders should note: the replayed lab-user traffic contained end users' names, contact info, and corporate data (examples redacted in the report: a pharma capex model, a developer's live bot tokens/app secrets) — "likely inconsistent with privacy laws and the labs' own terms of service." Anthropic's countermeasures: adversarial-extraction classifiers, attribution-before-ban (take down the org, not the accounts), reasoning summarization before responding to make stolen transcripts less trainable, and Fable 5.1 preserved thinking (new API accounts cannot edit the context preceding encrypted reasoning).

Durable defender reads

  1. Static detection is a speed bump, not a cost. GTG-20006's detect → rebuild → re-test loop means signature-based defense no longer raises adversary cost reliably; pivot to behavioral and identity-based detection (what the sample does, whose session, from what workflow).
  2. "An AI agent performed nearly all of the work" is the volume warning. 34-hour 2,100-token-set dumps, 3-hour developer-token → cloud-admin escalations, and 30-target campaigns in 4 days assume machine-speed dwell time; response SLAs measured in days are mismatched. Contain what you can't outrun: shortest possible token lifetimes, tenant-segmented session stores, egress control on the collection side.
  3. Anything that ingests untrusted content while holding keys is the new perimeter: evaluation sandboxes (GTG-50020), LiteLLM-style proxy tiers, coding-assistant sessions (Mandiant case), MCP servers. Run credential-less sandboxes; treat model output and fetched content as attacker input.
  4. The reseller/trust ecosystem around AI is an attack surface of its own — fake Claude proxies that are credential harvesters in disguise, harvested-transcript markets feeding distillation, and stolen keys laundered as cover. Verify the model you are actually talking to; treat AI credentials like cloud credentials (rotate, scope, monitor anomalous geo/velocity).
  5. Backup poisoning defeats the restore reflex (GTG-50029). Verify backup integrity before restore the same way you verify boot media.

Confidence and caveats

  • GTG designators are Anthropic-internal; only GTG-20006 carries an explicit external-correlation statement ("consistent with public reporting linking the actor to Midnight Blizzard"), and ShinyHunters-affiliate framing is Anthropic's assessment of shared objectives across "seemingly disparate" operators. No law-enforcement or multi-agency confirmation accompanies this report.
  • Victim organizations are not named and victim counts are per-case, disrupted-set counts — lower bounds on pre-disruption activity, not industry-wide prevalence.
  • The GTG-50020 "pre-release model access" goal is Anthropic's account of the actor's stated intent, and Anthropic is explicit that no path succeeded and Anthropic's own systems were not compromised.
  • SenseTime/MiniMax distillation findings rest on Anthropic's platform-side attribution (accounts, proxy infrastructure); the named companies (Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, MiniMax) have not publicly responded as of this note. Treat as single-source platform evidence pending third-party corroboration.
  • The GTG-20006 ↔ Storm-2945 hospitality overlap is a tradecraft and targeting convergence, not a proven same-operator identity from Anthropic's side.

Sources