[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGG3cGhBTMkZvc-00L2IiFJPp713XXrPZCHt0LtJgVbo":3},{"article":4,"iocs":56,"watch_terms":73,"solutions":74,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7a722a56-f69e-4513-b149-4e2f25ff620a","Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion","anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion-b4a090","Anthropic reveals how criminal groups are increasingly targeting AI vendors' own infrastructure, including to steal a pre-release Claude model. The post Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion appeared first on SecurityWeek.","Anthropic has disrupted a cyberespionage operation linked to the Russian state-nexus group Midnight Blizzard, which used Claude AI to automate malware evasion. The attackers targeted over 20 organizations, including government ministries and defense bodies, and also exfiltrated sensitive data and stole a proprietary software development kit. The report also highlights a growing trend of threat actors targeting AI infrastructure itself, such as by stealing API keys and attempting to gain access to pre-release AI models.","Russian hackers used Claude AI to automate malware evasion and target organizations.","https:\u002F\u002Fwww.securityweek.com\u002Fanthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FMidnight-Blizzard-Russia-1024x576.png","2026-09-11T08:47:07+00:00","2026-09-11T10:00:28.425382+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Midnight Blizzard","threat_actor",{"name":21,"type":22},"Claude","product",{"name":24,"type":25},"Anthropic","vendor",{"name":27,"type":19},"GTG-50021",{"name":29,"type":19},"GTG-50020",{"name":31,"type":32},"CaptiveCrunch","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64,67,70],{"type":58,"value":59,"context":60},"mitre_attack","T1071.001","DNS Hijacking delivery method",{"type":58,"value":62,"context":63},"T1110.004","Stolen admin credentials for DNS hijacking",{"type":58,"value":65,"context":66},"T1598.003","Phishing for information to compromise WhatsApp accounts",{"type":58,"value":68,"context":69},"T1041","Exfiltration of conversations via WhatsApp companion device linking",{"type":58,"value":71,"context":72},"T1071.004","DNS Hijacking via compromised hospitality vendors",[24,21],{"controls":75,"vendors":160},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":106,"name":107,"problem":108,"products":109},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":135,"name":136,"problem":137,"products":138},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[139,144,152],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":140,"product_name":141,"url":142,"description":143},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":178},"russian-hackers-weaponize-claude-ai-for-automated-malware-evasion","Russian Hackers Weaponize Claude AI for Automated Malware Evasion","Midnight Blizzard, a Russian state-nexus threat group, leveraged Anthropic's Claude AI to automate malware evasion techniques, targeting over 20 government and defense organizations. The attackers also stole API keys and attempted to access pre-release AI models, demonstrating that AI platforms themselves are now high-value targets. This incident highlights a dangerous new frontier: adversaries are actively abusing legitimate AI tools to accelerate and sophisticate cyberattacks, lowering the skill barrier for advanced operations. The theft of a proprietary SDK further illustrates that intellectual property and development assets are prime targets in espionage campaigns. Organizations must now account for AI-assisted threats in their defensive models and treat AI API credentials with the same rigor as privileged access credentials.",[166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-6 – Audit Record Review and Analysis","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST AI RMF – GOVERN 1.1, MANAGE 2.2 (AI Risk Management Framework)","MITRE ATT&CK T1027 – Obfuscated Files or Information (Malware Evasion)","MITRE ATT&CK T1078 – Valid Accounts (API Key Abuse)","GDPR Article 32 – Security of Processing (for EU-affected organizations)",{}]