Case anthropic-jackpoterz-russiaState actor AI opsWorldwide
Russia-aligned actor used AI agents to self-rebuild malware and steal ID records
Anthropic's threat report described a Midnight Blizzard-like operator whose agents auto-rebuilt detected malware, raided drone makers and stole 300,000+ national ID records.
CriticalAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- Worldwide
- Target
- Ukrainian/European defense, drone makers, North African government
- Severity
- Critical
- Triggered by
- Suspected Russia-aligned actor consistent with Midnight Blizzard (SVR-linked)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Anthropic's threat report described a Midnight Blizzard-like operator whose agents auto-rebuilt detected malware, raided drone makers and stole 300,000+ national ID records.
Impact: Entire mailboxes stolen from two drone component makers, a drone vision SDK taken, and 300,000+ national identity records exfiltrated from a North African government agency
Who triggered it
Actor: Suspected Russia-aligned actor consistent with Midnight Blizzard (SVR-linked)
Attribution: Anthropic assessed activity as consistent with Midnight Blizzard; described as suspected, not confirmed
Motive: Espionage against Ukrainian government, military, diplomats and defense suppliers
How it happened
Attack vector: Phishing, hotel Wi-Fi hijacking and WhatsApp account takeover, with Claude agents automating malware rewriting when detected and mailbox extraction
Root cause: Abuse of commercial AI agents to automate detection-evasion and intrusion tasks at scale; targets' exposure to phishing and account takeover
Timeline
- Start of the eight-month period covered by Anthropic's report
- Anthropic detects and disrupts the accounts involved
- Anthropic publishes Detecting and countering misuse of AI threat report
Response
Anthropic dismantled the accounts, upgraded safety classifiers and shared intelligence with governments and industry peers
Current status: Contained
Sources (open in a new tab)
- CyberScoop cyberscoop.com
- Anadolu Agency aa.com.tr
- The Register theregister.com
Cite this case
Russia-aligned actor used AI agents to self-rebuild malware and steal ID records. AI Threat Watch, case anthropic-jackpoterz-russia, Sep 10, 2026. https://aithreat.io/cases/anthropic-jackpoterz-russia/
Permanent link: https://aithreat.io/cases/anthropic-jackpoterz-russia/