# Anthropic says Russian-linked group used Claude to rebuild malware after detection

_Published Friday, September 11, 2026 at 1:06 PM EDT · Security, AI · Latest · Tier 2 — Notable_

![Anthropic says Russian-linked group used Claude to rebuild malware after detection — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtfzeoSe_6tXrJiKsyJfN4vYk6suLsJPF3-SOJWE8LAaZ6_WixrsJVjZ0T8O6jdtB1d08IR8swK6H0B4S_m7-0YfIiJlVPHuL7guxwC-4ANLXUyNsEWfIusPzvOMPOKSBmFcBT1NBBVWIglIRlT8fs6O9Uc6ZRBRgWZNPbvgAVIj8gIXfusRwZh0tndhni/s1700-nu-rw-lo-l85-e365/claude-malware.jpg)

Anthropic said Thursday it disrupted a campaign by a Russian state-sponsored threat actor it tracks as GTG-20006, which it links to reporting on Midnight Blizzard (APT29/Cozy Bear).

According to Anthropic, the group built an AI-assisted workflow that monitored whether its deployed malware was caught by security products and then autonomously modified and rebuilt the toolkit to evade those detections. Anthropic said the actor used AI across its operations, including domain registration, phishing infrastructure, and command-and-control monitoring, and targeted more than 20 organizations in Ukraine, Europe, the Middle East, and Asia.

Anthropic also said the actor compromised at least three hotel Wi-Fi vendors and used DNS hijacking to redirect guest traffic.

## Sources

- [The Hacker News](https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html)

---
Canonical: https://techandbusiness.org/newswire/FquomCRAGA9_HmbI12uze4
Published: 2026-09-11T17:06:18.716Z
Story chronology: 2026-09-11T14:10:20.000Z
Retrieved: 2026-10-27T13:19:26.597Z
Publisher: Tech & Business (techandbusiness.org)