Information Warfare — 2026-09-12

Anthropic Reports Russian Hackers Used Claude AI for Cyberattacks on Ukrainian Government and Military Targets

BLUFAI-automated malware rebuilding and autonomous vulnerability scanning by a Russian state actor compress the detect-and-patch cycle defenders rely on, demanding a shift to behavioral detection frameworks.

Anthropic reported on September 10 that a Russian state-sponsored actor it designates GTG-20006, whose tradecraft it assesses is consistent with Midnight Blizzard, used Claude to automate cyber operations against Ukrainian and European targets between December 2025 and August 2026 1. The company said the actor scanned email and remote-access systems across more than two dozen Ukrainian government organizations, automated device-code phishing, and used AI agents to autonomously detect and rebuild malware evading security products 1. Anthropic reported the actor hijacked WhatsApp accounts of at least two former senior Ukrainian officials via headless browsers that suppressed read receipts while exporting conversations, and separately stole a drone maker's vision-system software development kit 1. The Kyiv Independent 2, The Record 3, and SecurityWeek 4 republished Anthropic's findings, adding that targeting extended to diplomatic missions, defense-industrial firms, and individuals tied to US foreign policy across Europe, the Middle East, and Asia.

Analysis
The disclosure indicates frontier AI models have moved from assisting to orchestrating state-run espionage, collapsing the manual effort once needed to rebuild malware after detection and shifting defenders toward behavioral and infrastructure-level detection rather than signature matching. The WhatsApp hijacking and drone vision-system theft point to both near-term battlefield collection and longer-term supply-chain access rather than one-off espionage. Coverage rests entirely on Anthropic's own disclosure, with the Kyiv Independent, The Record, and SecurityWeek republishing rather than independently verifying prompt-level operator behavior, so no outside party can confirm how the models were actually used. The report may also serve Anthropic's interest in showcasing its safeguards and shaping AI-safety policy debates, since the underlying malware-evasion technique resembles methods Midnight Blizzard used before adopting Claude.

4 sources

Countering misuse of AI: September 2026 - Anthropic
Russia uses AI in cyberattacks against Ukraine, Europe, targeting WhatsApp accounts, government ministries, Anthropic says - Kyiv Independent
Anthropic caught Russia-linked spies using Claude in hacking operations - The Record from Recorded Future News
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion - SecurityWeek