A Russia-linked hacking group used the artificial intelligence system Claude at almost every stage of a large-scale cyber-espionage campaign targeting Ukrainian government, military and diplomatic organisations. Separately, Anthropic has uncovered attempts to use its models to develop software for combat drones, missile systems and potentially dangerous biological research.<\/p>\n
In a new report on the misuse of artificial intelligence, Anthropic has described a group with the internal designation GTG-20006<\/strong>. The company states that its methods and choice of targets are consistent with its publicly known activities Midnight Blizzard<\/strong> \u2014 a Russian cyber group that the US authorities had previously linked to the Russian Foreign Intelligence Service.<\/p>\n The criminals used Claude<\/a> not just for writing individual pieces of code. According to Anthropic, artificial intelligence was integrated into a significant part of the operation: from identifying potential targets and setting up phishing infrastructure to maintaining access to compromised systems and processing the stolen information.<\/p>\n The company has installed more than 20 organisations<\/strong>, \u2026 which were involved in the planning, reconnaissance or direct operations carried out by the hackers. These included ministries, defence and intelligence agencies, diplomatic missions, think tanks and defence enterprises. A significant proportion of the targets were concentrated in Ukraine and Europe.<\/p>\n Anthropic also reported that the attackers had been scanning email and remote access systems more than two dozen Ukrainian state organisations<\/strong>.<\/p>\n Technologies relating to Ukrainian drones have become one of the main areas of focus for Russian cyber-intelligence.<\/p>\n According to Anthropic<\/a>, the hackers gained access to the email accounts of at least two manufacturers of drone components, attacked a company that manufactures military UAVs, and stole the complete, proprietary software suite for the machine vision system of one of the drones.<\/p>\n The attackers then spent several days analysing the data they had obtained, attempting to determine the system\u2019s architecture, the components used, dependencies on suppliers and information about the product, which had not yet been publicly unveiled at that point.<\/p>\n According to Anthropic, military drone control systems and software related to computer vision and artificial intelligence were of particular interest.<\/p>\n To achieve specific objectives, the attackers targeted not the Ukrainian officials themselves, but the infrastructure they might use whilst travelling.<\/p>\n Anthropic has identified a breach involving at least three companies that provided services for the hotel\u2019s Wi-Fi networks<\/strong>. Once they had gained administrative access, the hackers altered the DNS settings, redirecting visitors\u2019 traffic through infrastructure they controlled.<\/p>\n This enabled them to obtain technical information about users\u2019 devices and create the conditions for delivering malware to Windows, Android and iOS systems. Among the priority targets were individuals with links to Ukraine, in particular civil servants and representatives of drone manufacturers.<\/p>\n Microsoft had previously described a similar campaign separately, referring to it as CaptiveCrunch<\/strong> and linked the relevant activity to the Midnight Blizzard sub-cluster.<\/p>\n Hackers also attempted to gain access to WhatsApp accounts<\/strong>. According to Anthropic, they linked the compromised devices as secondary accounts to the victims\u2019 accounts and downloaded large volumes of correspondence in Ukrainian and Russian.<\/p>\n At least two former high-ranking Ukrainian officials<\/strong> became the targets of such operations.<\/p>\n One of the most telling details in the report is the way in which artificial intelligence is used to bypass cyber defences.<\/p>\nUkrainian drones were of particular interest<\/h2>\n
Hackers used Wi-Fi in hotels to attack WhatsApp<\/h2>\n
The AI automatically rewrote the malicious programmes<\/h2>\n