Anthropic says a Russia-linked actor automated malware evasion. Static detections now impose less cost.

The attacker closed the detection-evasion loop

Anthropic’s September threat report describes GTG-20006, an espionage actor whose attribution it says is consistent with public reporting on Midnight Blizzard. Anthropic observed targeting of military intelligence, government, diplomatic, defence and foreign-policy organisations, with more than 20 distinct organisations appearing in planning, reconnaissance or live operations.

The operational change is the feedback loop. AI agents monitored whether security products detected deployed malware. When a tool was flagged, the workflow modified and rebuilt it, checked it again and continued until it was undetected. The refreshed tool was then staged on disposable infrastructure for phishing, ClickFix and DNS-hijacking operations.

That does not make signatures useless. It shortens their useful life and reduces the cost a new signature imposes on the attacker.

AI covered the workflow, while the operator refined the skills

Anthropic says the actor used customised workflows across development, infrastructure acquisition, phishing, persistence, command and control, and data exfiltration. The toolkit included Windows implants, mobile exploitation capability, browser credential theft, a phishing platform and an administrative console.

The human operator remained consequential. Anthropic reports that the person mainly modified Claude Code skills when the workflows needed refinement. Target selection and operational intent still came from the actor. Automation supplied speed, repetition and breadth.

Where the reported AI assistance appeared

Stage	Reported use	Defensive evidence
Reconnaissance	Fingerprint services and build target lists	External scanning and identity telemetry
Initial access	Prepare phishing and intrusion tooling	Device-code, DNS and email controls
Evasion	Test, modify and redeploy detected malware	Process, network and sequence behaviour
Collection	Organise and extract stolen data	Mailbox, storage and egress logs
Persistence	Register controlled devices and maintain accounts	Tenant and device audit trails

Defenders need detections that do not depend on one payload hash

Keep fast signature deployment, but connect it to controls the attacker cannot refresh as cheaply. Hunt for the sequence around a changing binary: the same delivery theme, parent process, credential access, outbound destination class, persistence action or device registration.

For cloud email, alert on device-code authentication followed by unusual mailbox export or a new companion device. For endpoints, retain behaviour and memory evidence when a binary changes hash. For DNS and hospitality suppliers, monitor administrative changes and require strong reauthentication for record updates.

The report also makes AI-service telemetry part of threat intelligence. Providers can see repeated build-test-modify patterns that one victim cannot. Sharing those patterns quickly matters more as the rebuild cycle accelerates.

The position

AI is shifting part of the attacker’s advantage from novel exploitation to cheap iteration. A capable operator can ask an automated system to absorb each defensive signal and try again.

Security programmes should measure how quickly a detection produces a durable control across identity, behaviour and infrastructure. If the response stops at a file hash, the attacker can now regenerate faster than many organisations can distribute the block.