Russia-linked group used Claude AI for espionage, disinformation and drone-swarm tooling

A Russia-linked hacking group has used Claude AI to automate cyber-espionage against Ukrainian and European government targets, according to a report published by Anthropic. The company said the same activity was also used to support disinformation campaigns and to develop targeting software for autonomous drone swarms. It said it had blocked the malicious use it identified and shared the findings with government and industry partners.

Sponsored

Anthropic said the main case involved a group it designated GTG-20006, which it said used Claude to operate against more than 20 organisations. Those targets included government ministries, defence and intelligence agencies, embassies, think tanks and defence-industrial companies. Ukraine was the primary target, while suppliers of military drone technology and their supply chains were also among those attacked.

The company said the group used the model in several ways, including as an engineering assistant to write malware, phishing kits and surveillance tools. It also said Claude was used as an executor of commands on victims' networks, including collecting credentials and extracting data under human direction. In some cases, Anthropic said, the activity was carried out with minimal human oversight.

Anthropic linked GTG-20006 to Midnight Blizzard, a hacking group that Western intelligence assessments attribute to Russia's foreign intelligence service, the SVR. The report also said the same broader activity extended to disinformation operations in Africa and Moldova. That combination of espionage, influence activity and military-adjacent tooling highlights how generative AI can be used across several parts of a hostile cyber operation.

Sponsored

The report added a separate example involving a Russian-speaking individual in Bangui, who was said to be running a disinformation operation for Radio Lengo Songo. Anthropic said the station was set up and financed in 2017 by the Kremlin-run mercenary Wagner group, and that the operator prepared daily pro-Russian content in coordination with Russian state outlets and a local Russian House cultural centre. The content, according to the investigation, promoted the Central African Republic government and Wagner while attacking France and domestic opposition figures.

The findings point to a wider pattern in which AI tools are being adapted for intelligence gathering, influence operations and battlefield support. Anthropic said it had strengthened its security systems after identifying the activity, but it did not say whether the group had been fully disrupted beyond the accounts and uses it blocked. It remains unclear how long the operations continued before detection, how much data may have been taken, and whether other actors used similar methods in parallel.

#Russia #ClaudeAI #cyberespionage #disinformation #droneswarms