{"data":{"id":"8379d143-d445-4784-9d9f-bef96d5acc2f","title":"Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection","summary":"Russian state-sponsored hackers (a group called GTG-20006, linked to APT29) abused Claude AI to create an automated system that detects when their malware is caught by security tools, then automatically rebuilds and redeploys it to stay ahead of defenders. The group used AI workflows across their entire operation, targeting military, government, diplomatic, and defense organizations in Ukraine, Europe, the Middle East, and Asia, including attacks through compromised hotel Wi-Fi networks and phishing schemes.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html","publishedAt":"2026-09-11T14:10:20.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["model_theft","supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude","Anthropic","GTG-20006","Midnight Blizzard","APT29","Cozy Bear"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-11T14:10:20.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}