Anthropic disrupted a cyberespionage campaign that matched the Russian state-nexus group Midnight Blizzard, which used Claude to iteratively modify malware, evade detection, and target more than 20 organizations across government, defense, intelligence, and industry sectors. The report also highlights attacks on AI infrastructure and credentials, including fraudulent Claude reselling, prompt injection to steal API keys, and attempts to access a pre-release Claude model. #MidnightBlizzard #Claude #CaptiveCrunch #GTG50021 #GTG50020
Keypoints
- Anthropic stopped a cyberespionage operation linked to Midnight Blizzard.
- The attackers used Claude to refine malware until it evaded detection.
- More than 20 organizations were targeted, including ministries and embassies.
- The group stole mailboxes, drone-related IP, and hijacked WhatsApp accounts.
- Attackers also targeted AI credentials, APIs, and pre-release model access.