Espionage actor used Claude workflows to phish and steal data from Ukraine-linked targets
Anthropic says its attribution of GTG-20006 is consistent with public reporting linking the actor to Midnight Blizzard. The actor used Claude-driven workflows to phish, keep access, rebuild detected malware and exfiltrate data from over 20 targeted organizations, mostly in Ukraine and Europe. It took drone component makers' mailboxes and a drone vision SDK, hijacked DNS at hotel WiFi vendors, and stole over 300,000 national ID records from a North African agency.
Sources
- Primary: https://www.anthropic.com/threat-intelligence-report-september-2026
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 453 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.