Ledger / 10 Sep 2026
Midnight Blizzard-linked GTG-20006 automated espionage and malware rebuilds
Confirmed
Anthropic reports from its own investigation and attribution.
AI agents watched for detections of the actor's malware and rebuilt it until undetected, and ran phishing and infrastructure workflows.
“agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections”Anthropic
Sources
- Detecting and countering misuse of AI: September 2026Anthropic · 10 Sep 2026 · primary source
- Disclosed
- 10 Sep 2026
- Activity
- 2026
- Actor
- GTG-20006 (consistent with Midnight Blizzard) (nation state), as attributed by Anthropic
- Nexus
- Russia
- Targets
- Ukrainian and European governments, defense, drone suppliers
- What the AI did
- Recon, Agentic intrusion, Malware dev, Evasion, Phishing content, Ops automation
- Model
- Claude Code, Claude
- Model family
- Anthropic
- Model basis
- stated by vendor
- Autonomy
- autonomous
- Outcome
- 20+ organizations targeted; mailboxes exfiltrated; accounts banned.