{"id":1221,"date":"2026-09-11T16:56:59","date_gmt":"2026-09-11T14:56:59","guid":{"rendered":"https:\/\/familiebuckens.nl\/?p=1221"},"modified":"2026-09-15T16:58:17","modified_gmt":"2026-09-15T14:58:17","slug":"russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection","status":"publish","type":"post","link":"https:\/\/familiebuckens.nl\/index.php\/2026\/09\/11\/russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection\/","title":{"rendered":"Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Anthropic on Thursday <a href=\"https:\/\/www.anthropic.com\/threat-intelligence-report-september-2026\" target=\"_blank\" rel=\"noopener\">revealed<\/a> it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The operation has been attributed to a cyber espionage group it calls <strong>GTG-20006<\/strong> (where &#8220;GTG&#8221; stands for Generative Threat Group), which aligns with broader reporting linking the cluster to <a href=\"https:\/\/thehackernews.com\/2024\/03\/microsoft-confirms-russian-hackers.html\" target=\"_blank\" rel=\"noopener\">Midnight Blizzard<\/a> (aka APT29 and Cozy Bear).<\/p>\n\n\n<a class=\"wp-block-read-more\" href=\"https:\/\/familiebuckens.nl\/index.php\/2026\/09\/11\/russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection\/\" target=\"_self\"><a href=\"https:\/\/thehackernews.com\/2026\/09\/russian-state-sponsored-hackers-use.html\">Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection<\/a><span class=\"screen-reader-text\">: Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection<\/span><\/a>","protected":false},"excerpt":{"rendered":"<p>Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where &#8220;GTG&#8221; stands for Generative Threat Group),&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,3],"tags":[72,9],"class_list":["post-1221","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-malware","tag-72","tag-russia"],"_links":{"self":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/comments?post=1221"}],"version-history":[{"count":1,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1221\/revisions"}],"predecessor-version":[{"id":1222,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1221\/revisions\/1222"}],"wp:attachment":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/media?parent=1221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/categories?post=1221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/tags?post=1221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}