APT29 Abuses Claude to Auto-Rebuild Malware on Detection
Russian state-sponsored group GTG-20006, linked to APT29/Midnight Blizzard, weaponised Anthropic's Claude to build autonomous AI workflows that detect when their malware is flagged by security products and automatically rebuild and redeploy it to evade static detections. The operation targeted over 20 government, defence, and diplomatic organisations across Ukraine, Europe, the Middle East, and Asia, using phishing, ClickFix lures, and DNS hijacking to deliver cross-platform implants. This represents a qualitative escalation in adversarial AI use: LLMs are no longer just writing malware stubs but orchestrating full detection-evasion feedback loops at machine speed.