[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0TBFxwbhUcXM_-uvCXoZpo_CniqdOlqRUPhUsqmdtBw":3},{"article":4,"iocs":55,"watch_terms":73,"solutions":74,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7af3a22f-23d2-4af4-ad01-d85ee0b458a9","Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection","russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection-dae251","Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where \"GTG\" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight","A Russian state-sponsored threat actor, identified as GTG-20006 and linked to Midnight Blizzard (APT29), has been observed using Anthropic's Claude AI to develop an AI-assisted workflow for rebuilding and re-deploying malware. This tactic aims to bypass security detections and maintain operational persistence. The group has targeted Ukrainian and European government entities, as well as organizations involved in U.S. foreign policy, using a sophisticated toolkit that includes Windows and mobile implants, credential stealers, and a phishing platform.","Russian hackers used AI to rebuild malware, evading detection.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Frussian-state-sponsored-hackers-use.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgtfzeoSe_6tXrJiKsyJfN4vYk6suLsJPF3-SOJWE8LAaZ6_WixrsJVjZ0T8O6jdtB1d08IR8swK6H0B4S_m7-0YfIiJlVPHuL7guxwC-4ANLXUyNsEWfIusPzvOMPOKSBmFcBT1NBBVWIglIRlT8fs6O9Uc6ZRBRgWZNPbvgAVIj8gIXfusRwZh0tndhni\u002Fs1600\u002Fclaude-malware.jpg","2026-09-11T14:10:20+00:00","2026-09-11T16:00:29.069833+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"GTG-20006","threat_actor",{"name":21,"type":19},"Midnight Blizzard",{"name":23,"type":19},"APT29",{"name":25,"type":19},"Cozy Bear",{"name":27,"type":28},"Claude","product",{"name":30,"type":31},"CaptiveCrunch","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59,61,63,65,67,70],{"type":49,"value":57,"context":58},"PowerChrome","Windows malware deployed via ClickFix lures.",{"type":49,"value":60,"context":58},"WUEngine",{"type":49,"value":62,"context":58},"Shadow C2",{"type":49,"value":64,"context":58},"MiniPlasma",{"type":49,"value":66,"context":58},"CloudSyncSvc",{"type":49,"value":68,"context":69},"GiftDrop","Android surveillance RAT, rebranded version of GiftsExpress.",{"type":49,"value":71,"context":72},"DarkSword","iOS malware deployed via ClickFix lures.",[27],{"controls":75,"vendors":161},[76,105,133],{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":54,"name":106,"problem":107,"products":108},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":44,"name":134,"problem":135,"products":136},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[],{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":177},"apt29-uses-ai-to-rebuild-malware-and-evade-detection","APT29 Uses AI to Rebuild Malware and Evade Detection","Russian state-sponsored group APT29 (Midnight Blizzard) is leveraging AI tools like Anthropic's Claude to rapidly rebuild and redeploy malware after it has been detected and blocked by security solutions. This represents a significant escalation in adversary capability, as AI dramatically reduces the time and skill required to mutate malicious code and bypass signature-based defenses. The tactic directly undermines traditional detection-and-response cycles by allowing threat actors to outpace defender reaction times. Targeting government and foreign policy organizations underscores that no high-value sector is immune, and that detection alone is no longer a sufficient security outcome — persistent monitoring, behavioral analysis, and rapid containment are now essential.",[167,168,169,170,171,172,173,174,175,176],"NIST SP 800-61 Rev. 2 – Incident Response","NIST SP 800-137 – Continuous Monitoring","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","MITRE ATT&CK T1027 – Obfuscated Files or Information","MITRE ATT&CK T1587.001 – Develop Capabilities: Malware","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF RS.RP-1 – Response Planning","GDPR Article 32 – Security of Processing (for EU-targeted organizations)",{}]