Ledger / 10 Sep 2026
Iran-nexus GTG-30004 built OSINT profiling and obfuscated NanoDump
Confirmed
Anthropic reports from its own investigation.
The actor used Claude to orchestrate an OSINT profiling harness and an obfuscation pipeline for a modified NanoDump.
“modified an open-source LSASS credential dumper, NanoDump, and built a bespoke C++ obfuscation/build pipeline”Anthropic
Sources
- Detecting and countering misuse of AI: September 2026Anthropic · 10 Sep 2026 · primary source
- Disclosed
- 10 Sep 2026
- Activity
- 2026
- Actor
- GTG-30004 (nation state), as attributed by Anthropic
- Nexus
- Iran
- Targets
- Israeli officials and Jewish diaspora organizations
- What the AI did
- Recon, Malware dev, Evasion, Data analysis
- Model
- Claude
- Model family
- Anthropic
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Accounts disrupted.