# Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets

> Anthropic's September 2026 threat intelligence report discloses that Midnight Blizzard (APT29/Cozy Bear, tracked internally as GTG-20006, operator handle "JackPoterz") ran a Claude-orchestrated closed-loop malware evasion pipeline — test against security products, autonomously modify/rebuild/redeploy from disposable infrastructure until undetected — alongside hotel Wi-Fi DNS hijacking (CaptiveCrunch, Microsoft Storm-2945), device-code phishing against Microsoft Entra ID, WhatsApp companion-device account takeover, and drone-vision SDK theft/reverse-engineering, against 20+ Ukrainian, European, Middle Eastern, Asian and North African government, military, diplomatic and drone-supply-chain targets between December 2025 and August 2026.

- **Published:** 2026-09-11T00:00:00Z
- **Last reviewed:** 2026-09-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2446
- **ID:** TL-2026-2446
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UNC2452 (Russia)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Anthropic's "Detecting and countering misuse of AI: September 2026" report (published 2026-09-11) documents GTG-20006, an actor whose tradecraft and targeting Anthropic assesses is consistent with Russia's SVR-linked Midnight Blizzard (APT29/Cozy Bear/NOBELIUM/BlueBravo), operating under the handle "JackPoterz." Between December 2025 and August 2026, Anthropic identified and disrupted the group's use of Claude across nearly every stage of its intrusion lifecycle against more than 20 organizations spanning Ukrainian and European government ministries, defense and intelligence bodies, embassies and think tanks, with additional targeting in the Middle East, Asia, and North Africa.

The centerpiece TTP is an AI-orchestrated, closed-loop detection-evasion cycle: when a Windows or mobile implant was flagged by a security product, Claude-driven agents autonomously analyzed the detection, modified and rebuilt the malware's code, and redeployed it from disposable infrastructure, repeating the loop until the tool evaded existing signatures — compressing an evasion-development cycle that normally requires skilled malware developers into an automated, self-healing pipeline that outpaces defender response time.

Initial access into travelling officials' devices was achieved through CaptiveCrunch, a campaign independently documented by Microsoft Threat Intelligence (attributed to Storm-2945, a Midnight Blizzard initial-access sub-cluster with technical overlaps to Storm-2372) and researcher ReliaQuest. Storm-2945 compromised the shared management systems of hotel, conference-center, and airport captive-portal Wi-Fi providers and manipulated DNS/HTTP resolution to redirect guest traffic to attacker infrastructure. Two parallel abuse paths followed: (1) doppelganger domains impersonating Microsoft 365/Entra ID sign-in pages drove adversary-in-the-middle (AitM) phishing and abuse of the Entra ID device-code authentication flow — victims were induced to enter a device code into a legitimate Microsoft sign-in page, authenticating an attacker-controlled session instead; and (2) ClickFix-style fake browser/OS update prompts delivered a Windows-focused malware suite: CornFlake, a Go-based RAT (persisting as a "Cloud Sync Service" named svchost32.exe, with keylogging, clipboard/screenshot/webcam/microphone capture, browser credential theft via a ChromeKatz module, and a custom ECDH P-256-encrypted C2 protocol) and ChocoShell, an in-memory PowerShell infostealer (AMSI bypass, VM-detection, three UAC-bypass chains — SilentCleanup task hijack, wsreset.exe COM hijack, sdclt.exe folder hijack — and theft of Chromium/Firefox session cookies, Microsoft 365/Azure AD WAM tokens, and Wi-Fi credentials, beaconing over HTTPS disguised as an image-tracking pixel). Both implants were managed from FruitStone, a web-based C2 panel masquerading as a "CloudSync Console" SaaS product.

Beyond CaptiveCrunch, GTG-20006 hijacked the WhatsApp accounts of at least two former high-level Ukrainian officials by linking attacker-controlled headless browsers as companion devices (leveraging the WPPConnect automation library) and suppressing read receipts to silently export conversation history. The group also compromised the mailboxes of at least two drone-component manufacturers and used Claude to reverse-engineer a stolen proprietary drone-vision SDK, recovering product architecture, hardware bills of materials, and supplier dependencies. Separately, the actor exploited an authorization flaw in a camera-streaming service to steal stream-access tokens, and breached a North African government technology authority, exfiltrating over 300,000 national identity records and 500,000 commercial-registry entries.

Anthropic disrupted the associated Claude accounts, hardened relevant safeguards, and shared indicators with government and industry partners; it published domains, IPs, and file hashes for defenders to hunt against. Anthropic's report frames the case as evidence that stolen AI API keys, agent session tokens, and AI-service integrations must be treated with the same operational sensitivity as production credentials, since AI-accelerated development loops now let attackers iterate faster than traditional signature-based defenses can respond.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1556 Modify Authentication Process
- T1187 Forced Authentication
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1056.004 Credential API Hooking
- T1114 Email Collection
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography

## Sources

- [Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion](https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/)
- [Anthropic disrupts Russian, Chinese AI campaigns targeting its Claude models](https://www.rappler.com/technology/anthropic-threat-intelligence-report-september-2026/)
- [Midnight Blizzard-Linked Actor Used Claude AI to Automate Malware Detection Evasion](https://therecord.media/anthropic-russia-hackers-claude)
- [Countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)
- [Detecting and countering misuse of AI: September 2026 (full report PDF)](https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf)
- [CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)
- [Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 credentials and deploy malware](https://www.helpnetsecurity.com/2026/08/04/midnight-blizzard-hotel-wi-fi-networks-hacking/)
- [Midnight Blizzard Used Claude Agents to Automate Malware Evasion](https://mallory.ai/stories/01a08eaa-270f-7b86-9697-3d226718b49f)
- [Hackers Use Claude AI Agents to Automate Cyberattacks, Develop Zero-Days and Evade Detection](https://cybersecuritynews.com/claude-ai-agents-used-to-automate-cyberattacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2446