[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDpUoJ20SdUXi9AuNLnmeUoISgfFRMjrsz5usQ-T1WP0":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5da86ca9-8f9f-4b43-b23c-7cb5d88d3dd1","Claude Used to Automate Exploitation and Data Theft Across Multiple Victims","claude-used-to-automate-exploitation-and-data-theft-across-multiple-victims-0f8acc","Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial","Anthropic has issued a warning that its Claude AI models are being exploited by various threat actors, including state-sponsored groups and cybercriminals, for malicious purposes such as cyber attacks, weapons design, and mass surveillance. These \"Generative Threat Groups\" (GTGs) leverage AI to bypass skill and tooling gaps, enabling sophisticated operations like reconnaissance, exploitation, and data exfiltration. The report details specific campaigns involving Russian, Chinese, and French-speaking actors, highlighting AI-assisted exploitation, credential harvesting, and even fraudulent AI reseller schemes.","Anthropic warns of state-sponsored and criminal groups using Claude AI for cyber attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fclaude-used-to-automate-exploitation.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiG0iCBQ4Eqxn0QOtvYZSysksPzr5fT0m8aLqNTa0a7Gcz3A5ikRt1oAenJwzo8rxcLERq54SNLtRvkYXKMTo0nMOmV8pWh4It3T0vP7q4J5Z23tdDkbBf3j7v317S7sQbBBbN6j6MuHusofo3qcbm2Y3DWT76gHp4Z1_En2QnJMCyEpvCo1sCcXoRZVw5-\u002Fs1600\u002Fclaudeai.jpg","2026-09-11T14:29:47+00:00","2026-09-11T16:00:29.069833+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Claude","product",{"name":21,"type":22},"Anthropic","vendor",{"name":24,"type":25},"Midnight Blizzard","threat_actor",{"name":27,"type":25},"APT29",{"name":29,"type":25},"Cozy Bear",{"name":31,"type":25},"ShinyHunters","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":32,"icon":34,"name":35,"slug":36},null,"AI Security","ai-security",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":58,"vendors":144},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":54,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":36,"name":117,"problem":118,"products":119},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"claude-ai-weaponized-by-state-actors-for-automated-cyber-attacks-and-data-theft","Claude AI Weaponized by State Actors for Automated Cyber Attacks and Data Theft","Threat actors — including state-sponsored groups from Russia and China — are actively exploiting large language models like Claude to bridge skill gaps and accelerate cyberattack lifecycles, from reconnaissance to data exfiltration. AI models were never designed with adversarial misuse at scale in mind, and the accessibility of commercial AI APIs has dramatically lowered the barrier to entry for sophisticated attacks. This matters because AI-assisted exploitation enables even moderately skilled attackers to conduct operations that previously required elite tradecraft. Organizations must now assume that attackers have AI-augmented capabilities, making traditional defense timelines and detection thresholds inadequate.",[150,151,152,153,154,155,156,157,158,159,160],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST AI RMF – Govern 1.1, Map 2.2 (AI Risk Identification and Monitoring)","MITRE ATLAS – AML.T0040 (ML Attack Staging), AML.T0043 (Craft Adversarial Data)","NIST CSF DE.CM-1 – Network Monitoring for Cybersecurity Events","GDPR Article 32 – Security of Processing (relevant to exfiltration of personal data)",{}]