Anthropic has published its September 2026 threat report, revealing an unprecedentedly large-scale picture of abuse of the Claude model — from state-backed cyber espionage to industrial theft of AI capabilities. At the center is the campaign run by the group GTG-20006, whose attribution, according to Anthropic, is consistent with public reporting on Midnight Blizzard (APT29/Cozy Bear). The group built an automated pipeline in which AI agents monitored the detection of malicious artifacts by security products and autonomously rebuilt their toolkit to evade new signatures. In parallel, Anthropic uncovered and disrupted industrial-scale Claude distillation campaigns run by seven Chinese labs, including Alibaba, DeepSeek and Moonshot AI.
Automatic malware rebuilding: how the GTG-20006 pipeline worked
According to Anthropic, GTG-20006 set up a full cycle in which AI performed functions at every stage of the operation. Monitoring agents checked whether deployed implants were being detected by security products. When a detection was triggered, the agents autonomously modified and rebuilt the malware, after which the updated artifacts were placed on disposable servers for re-delivery to victims via phishing, ClickFix and DNS hijacking.
The group’s toolkit, according to the report, included:
- Two families of Windows implants (PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc)
- A mobile exploitation suite: GiftDrop (Android) and DarkSword (iOS)
- A credential theft tool targeting browser password stores
- A phishing platform impersonating government organizations
- An administrative console for managing compromised accounts
In addition to rebuilding malware, AI agents were used to register domains, configure hosting infrastructure and send phishing emails, as well as to monitor command-and-control (C2) channels for successful compromises. Anthropic separately notes that the attackers used auxiliary tools to block security updates on victim machines — so that new signatures would not be downloaded or applied.
This approach fundamentally changes the cost balance: whereas previously the release of new detections slowed down the attacker, automatic rebuilding now reduces the effectiveness of static signatures to a minimum. For defenders, this means the need to correlate recurring mutations of artifacts with signs of blocked updates on endpoints and not rely solely on signature-based analysis.
Scale and targets of the campaign
According to Anthropic, GTG-20006 targeted more than 20 organizations — ministries, defense and intelligence agencies, embassies, diplomatic missions, think tanks and defense-industrial enterprises, primarily in Ukraine and Europe. The attacks also affected the Middle East and maritime government agencies in Asia.
One separate vector was the compromise of at least three hotel Wi‑Fi providers. Using stolen administrative credentials, the attackers modified DNS records so that guest traffic, device identifiers and IP addresses were redirected to the group’s servers. Victims were then served ClickFix lures delivering malware tailored to the device platform.
Anthropic also reports the compromise of a North African state technology agency with the exfiltration of more than 300,000 national ID records and commercial registry data for more than half a million companies. In addition, the Embassy Kit phishing platform, which uses device code phishing to steal tokens, enabled unauthorized access to Microsoft 365 mailboxes at at least eight organizations, including a military educational institution and a prosecutor’s office.
Additional techniques included WhatsApp account takeovers via headless browsers by connecting companion devices and mass-exporting Russian- and Ukrainian-language chats, as well as exploiting authorization vulnerabilities in video surveillance streaming services to gain access to victims’ cameras.
Indicators of compromise
Anthropic has published network and host indicators for the campaign. Domains include:
- ms365-live[.]com, teams.ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com
- chamber-ua[.]org, chathamhouse[.]eu, ukrinform-share[.]net
- wa-connect[.]eu, wa-meeting[.]com, cdncounter[.]net
IP addresses: 104.145.210[.]184, 31.57.243[.]154, 104.194.151[.]133, 144.172.114[.]192, 213.145.86[.]112, 185.198.234[.]26, 185.198.234[.]101 and others.
File hashes: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c, 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593.
Industrial Claude distillation: seven Chinese labs
The second major part of the report focuses on illegal distillation — the industrial-scale extraction of model capabilities through mass queries from fake accounts. Anthropic has identified six campaigns since February 2026:
- Alibaba (GTG-16005) — the largest attack recorded: more than 151 million exchanges between May and July 2026, peaking at about 3 million requests per day from more than 3,500 fake accounts, aimed at extracting the reasoning chains of Claude Opus 4.6 and 4.7
- Moonshot AI (GTG-16002) — covertly redirected Kimi user queries to Claude, displaying Claude’s answers as its own while simultaneously saving the exchanges for training. Over 10 days it generated nearly 300,000 requests via 5,380 fake accounts
- DeepSeek (GTG-16001) — a similar setup with redirection of user queries, with more than 12.1 million exchanges over 14 days
- Zhipu/Z.ai (GTG-16006) — more than 3.4 million exchanges via 273 fake accounts
- Xiaomi (GTG-16008) — more than 400,000 exchanges, with sessions redirected from its own MiMo models
- SenseTime (GTG-16012) — purchased transcripts of user exchanges with Claude from third-party resellers
- MiniMax (GTG-16003) — created its own proxy network through a shell company
All of these data are based solely on Anthropic’s investigation and have no independent confirmation in publicly available sources. We have already written about competition among AI labs in the cybersecurity context — the current allegations significantly escalate this topic.
To counter distillation, Anthropic has implemented a number of measures: blocking accounts from unsupported regions, mandatory identity verification, summarizing the model’s internal reasoning before returning a response (so that stolen transcripts are less useful for training), as well as the “preserved thinking” mechanism in Fable 5.1, which prevents new API accounts from modifying the system prompt and context before Claude’s reasoning.
Other threats in the report
In addition to GTG-20006 and distillation, the report documents dozens of other campaigns: from Chinese students conducting reconnaissance of government networks in the Middle East and Southeast Asia (GTG-10007), to Iranian actors developing mass-surveillance platforms, and an operator from Mali who designed an interception system for 25 million SIM cards. Anthropic also disrupted attempts to use Claude to design guided weapons, anti-torpedo systems and autonomous FPV drones.
Recommendations for defenders
The access vectors used by GTG-20006 described in the report include credential theft, device code phishing, DNS hijacking, malicious lures and token theft. This calls for comprehensive monitoring:
- Check your infrastructure for the published IOCs (domains, IP addresses, hashes) and block them at the perimeter
- Monitor for anomalies in DNS records, especially for hotel and public Wi‑Fi networks
- Control the integrity of security update mechanisms on endpoints — blocked updates may indicate an attacker’s presence
- Strengthen monitoring of Microsoft 365 tokens and auditing of devices linked to messengers
- Do not rely on static signatures as the only detection method — use behavioral analysis and correlation of repeated artifact mutations
The Anthropic report records a qualitative shift: AI agents have upended the economics of the contest, making automatic malware rebuilding cheaper than developing new detections. Organizations that match GTG-20006’s target profile — government, diplomatic and defense entities — should immediately check their infrastructure against the published indicators and revise their detection strategy in favor of behavioral methods that do not depend on static signatures of specific samples.
