A defender blocks a malware sample. The attacker detects the block, changes the implant, rebuilds it, and deploys a new artifact. That loop is old. Anthropic says a Russian-nexus espionage operator used AI workflows to automate much of it.

The result is not undetectable malware. It is a shorter useful life for detections that identify only one file, hash, domain, or build.

TL;DR

  • Anthropic tracks the actor as GTG-20006 and says its attribution is consistent with public reporting linking the activity to Midnight Blizzard.
  • The actor used AI across development, infrastructure, phishing, persistence, command and control, and exfiltration.
  • AI agents monitored whether deployed tools were detected and iteratively modified and rebuilt them until they evaded the tested defenses.
  • Anthropic identified more than 20 targeted organizations, concentrated in Ukrainian and European government, diplomatic, defense, intelligence, and drone-related sectors.
  • Defenders should keep fresh indicators, but anchor detection in identity flows, process behavior, persistence, egress, and authorization boundaries that a recompile does not erase.

Be Precise About Attribution

Anthropic does not simply declare that GTG-20006 is Midnight Blizzard. Its wording is more careful: the attribution is consistent with public reporting linking the actor to Midnight Blizzard, and one Russian-speaking operator’s tradecraft and targeting were consistent with Russian state-nexus espionage.

That assessment is credible and operationally relevant, but it remains an assessment. Microsoft separately attributes the related CaptiveCrunch campaign to Storm-2945, which it assesses is a Midnight Blizzard operational sub-cluster. Anthropic says parts of GTG-20006’s activity overlapped with CaptiveCrunch. These sources corroborate important behavior without proving that every cluster label maps one-to-one.

The Feedback Loop

Anthropic says GTG-20006 used two Windows implant families, a mobile exploitation kit, a browser-credential stealer, a phishing platform, and an administrative console. AI-assisted workflows managed and retooled those components.

The important change was feedback:

Deploy artifact
    -> monitor security-product detection
    -> modify and rebuild detected tool
    -> test the new artifact
    -> stage it on disposable infrastructure
    -> redeploy through phishing, ClickFix, or DNS hijacking

Anthropic observed human direction in the operation. The operator chose targets and refined the Claude Code skills driving the workflows. Calling this a fully autonomous campaign would overstate the evidence. Calling it ordinary chatbot assistance would understate it: scheduled jobs renewed stolen tokens and collected cloud data, while agents handled repeated operational work.

The initial-access methods remained familiar. Anthropic reported device-code phishing, ClickFix lures, stolen credentials, compromised hotel Wi-Fi providers, DNS hijacking, malicious mobile packages, and cloud-email theft. AI increased speed and parallelism; it did not repeal authentication, endpoint, or network telemetry.

Make Detections Expensive to Evade

A hash rule is cheap to change because the attacker controls the build. The following signals are tied to what the operation must accomplish:

Defensive layerDetect or preventWhy recompiling does not solve it
IdentitySuccessful device-code authentication, new device registration, unfamiliar application IDs, refresh-token use from new infrastructure, and bulk mailbox access after an unusual sign-in.The attacker still needs a token, device relationship, and access to cloud data. Microsoft exposes device-code use in Entra sign-in logs.
EndpointA browser or user-facing application leading to a shell, script interpreter, installer, or unsigned binary; new persistence; credential-store access; security-setting changes; and repeated near-identical executions after quarantine.Source code and hashes can change, but execution lineage and objectives remain constrained.
NetworkFirst-seen domains, disposable hosting, encrypted egress from unusual processes, DNS-setting changes, and a managed endpoint reaching sensitive services before its corporate tunnel is established.New domains are replaceable, but infrastructure acquisition and victim-to-C2 communication remain observable.
Application controlBlock code outside approved signers, paths, package sources, and managed installation workflows. Restrict script interpreters for users who do not need them.A newly generated artifact is still unapproved code.
Data accessAlert on mailbox export, high-volume Graph requests, secret-store enumeration, browser credential access, and collection inconsistent with the identity’s job.Exfiltration needs data reads even when the implant is novel.

Static indicators still deserve rapid blocking. Anthropic published domains, IP addresses, filenames, and two hashes for immediate hunting. Treat them as pivots into a longer timeline: which identity resolved the domain, which process connected, what ran before it, which token appeared next, and what data that token accessed.

Close the Human Entry Paths

For Microsoft Entra ID, inventory device-code flow in report-only mode and block it with Conditional Access wherever it is not required. Microsoft recommends getting as close as possible to a unilateral block. Where Teams rooms, command-line tools, or other legitimate cases need the flow, use documented, narrow exceptions and monitor the Authentication protocol and Original transfer method fields.

Train users on an action, not a slogan:

  • A website, CAPTCHA, hotel portal, recruiter, or support message must never instruct them to paste a command into PowerShell, Terminal, Run, or a browser developer console.
  • A device code is a sign-in credential. Enter it only when they personally initiated setup on the named device and the consent screen shows the expected application.
  • A Wi-Fi portal must not require an APK, “security update,” browser extension, or device-management profile. Disconnect and report it.
  • On travel networks, complete only the minimal captive-portal step, then establish the managed VPN before accessing company services. Certificate warnings are a stop signal, not a troubleshooting step.

Run a Feedback Loop of Your Own

Detection engineering must learn as quickly as the attacker changes artifacts. When an endpoint blocks a sample, automatically enrich the event with process ancestry, signer, file origin, user, DNS, network connections, identity activity, and related executions across the fleet. Cluster similar behavior even when hashes differ.

Test closure with an approved purple-team sequence: simulated device-code use, a benign ClickFix-like child process, a first-seen domain, and a staged mailbox export. The exercise succeeds only if the events become one incident quickly enough to revoke tokens, isolate the endpoint, block infrastructure, and preserve evidence before the sequence finishes.

AI reduced the attacker’s cost of rebuilding malware. Defenders should answer by making the expensive parts—obtaining trusted identity, executing unapproved code, maintaining persistence, and extracting data—visible and revocable.

Sources