{
 "Event": {
  "uuid": "ed609681-141a-5889-9879-62a039024462",
  "info": "Anthropic disrupts APT29-linked GTG-20006 AI-assisted malware rebuild operation",
  "date": "2026-07-01",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"espionage\""
   },
   {
    "name": "misp-galaxy:threat-actor=\"APT29\""
   },
   {
    "name": "misp-galaxy:country=\"ukraine\""
   },
   {
    "name": "misp-galaxy:country=\"poland\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"israel\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Military Intelligence\""
   },
   {
    "name": "misp-galaxy:sector=\"Diplomatic Missions\""
   },
   {
    "name": "misp-galaxy:sector=\"Defense\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/anthropic-disrupts-apt29-linked-gtg-20006-ai-assisted-malware-rebuild-operation/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Anthropic disclosed in September 2026 that it had disrupted GTG-20006, a cluster attributed to Midnight Blizzard/APT29/Cozy Bear, which had constructed an AI-driven process to monitor its malware against security products and automatically rebuild and redeploy any toolkit that was detected. The group additionally used the model to register domains, establish hosting and manage command-and-control channels. Operations ran July to September 2026 against more than 20 organisations across Ukraine, Europe, the Middle East and Asia, targeting military intelligence, diplomatic and defence bodies and individuals connected to US foreign policy. The malware set included PowerChrome, WUEngine, Shadow C2, MiniPlasma and CloudSyncSvc on Windows plus GiftDrop for Android and DarkSword for iOS, overlapping with the CaptiveCrunch campaign.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}