Anthropic said Russian hackers used Claude across cyber-espionage operations
Anthropic said the Russian group Midnight Blizzard used Claude between December 2025 and August 2026 to target more than 20 European and Ukrainian entities. The reported activity included phishing, credential theft, data exfiltration and efforts to evade security tools.
By DoomRadar · Published on DoomRadar . Updated .
Places in the report
- Ukraine[1]
Countries named in the cited reporting. Highlighting does not show the area affected. Map: Natural Earth.
How the effects could reach youConditional effects
Based on two sources with available article excerpts. Source-linked claims are not independent confirmation.
Event date: The reported operations took place between December 2025 and August 2026. [1][2]
What happened
TechCentral, citing Anthropic, reported that Midnight Blizzard attacked more than 20 entities in Europe and Ukraine between December 2025 and August 2026. [1]
References for this detail (1)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
The reported targets included intelligence services, military organizations, defense contractors and diplomatic missions, with the AI used to help locate targets and build phishing networks. [1]
References for this detail (1)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
Once attackers entered networks, Claude reportedly assisted lateral movement and the theft of hundreds of gigabytes of sensitive data. [1]
References for this detail (1)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
The group reportedly targeted military UAV manufacturers and drone-parts suppliers, taking email archives and development tools for drone software. [1]
References for this detail (1)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
The reporting also described compromised hotel Wi-Fi providers and altered DNS records that redirected guest traffic to malicious servers affecting iOS, Android and Windows devices. [1]
References for this detail (1)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
Anthropic-related reporting said the model was used to analyze antivirus detections and rewrite malicious files to evade security defenses; these accounts describe alleged activity rather than independently established court findings. [1][2]
References for this detail (2)
- Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ie · Article published: Sep 14, 2026, 11:31 AM UTC
- Anthropic says Claude AI was used to build missiles, hunt Uyghurs and spy on 25 million phones: 5 'shocking cases' from its new threat reporttimesofindia.indiatimes.com · Article published: Sep 14, 2026, 11:11 AM UTC
Context from the sources
The reported activity extended beyond conventional network intrusion: attackers also hijacked WhatsApp accounts through a headless-browser platform and downloaded correspondence from Ukrainian and Russian accounts. [1]
Explore the sources and reporting timeline
2 source links · 2 domains
These counts describe the references, not independent confirmations. Different outlets can repeat the same original report.
Source timeline
Oldest to newest among the available source dates, not a chronology of the incident. Article publication dates come from the source; other recorded dates may reflect when a link was found.
- [2] Anthropic says Claude AI was used to build missiles, hunt Uyghurs and spy on 25 million phones: 5 'shocking cases' from its new threat reporttimesofindia.indiatimes.comReferenced for: detail 6
- [1] Russian hackers used Claude AI to automate cyberattacks on Europe and Ukrainetechcentral.ieReferenced for: detail 1, detail 2, detail 3, detail 4, detail 5, detail 6
Questions answered by the reporting
What kinds of organizations were reportedly targeted?
The targets included intelligence services, military bodies, defense contractors and diplomatic missions, according to the report. [1]
How was Claude used inside the reported attacks?
It supported target discovery, phishing, credential theft, lateral movement, data theft and rewriting malicious code after antivirus detections. [1]
What this could mean for you
Employees and travelers could encounter more convincing phishing or malicious hotel-network redirects.
The reported attackers used AI to build phishing infrastructure and compromised hotel Wi-Fi providers and DNS records.
Reported basis: [1] · The possible effect is interpretation.
Depends on: Similar access is maintained or replicated against other service providers.
Defense and diplomatic organizations could face larger data-loss investigations.
AI-assisted lateral movement and credential theft can help attackers reach more systems and remove large data volumes.
Reported basis: [1] · The possible effect is interpretation.
Depends on: Attackers obtain an initial foothold in a connected organization.
Possible consequences, not a forecast. Their relevance depends on your location and the conditions above.
For your country
Choose a country to check how this event could affect you.
What changes the outlook
Risk increases if…
Attackers retain access to compromised providers or networks and reuse the reported automation methods.
Security defenses fail to detect modified malicious files or stolen credentials.
Pressure eases if…
Targeted organizations revoke compromised credentials and isolate affected systems.
Security tools detect and block the reported phishing, DNS-redirection or malware-evasion techniques.
Still unclear
The excerpts do not identify the individual entities among the more than 20 targets or state whether all intrusions were fully contained.
They do not establish the amount of damage caused by the reported thefts or whether affected customers were notified.
Market implications
Market impact
Sources (2)
References for the reported details. Separate links do not necessarily mean independent confirmation.
Available excerpt
According to a report by Anthropic, the Russian hacker group Midnight Blizzard used the Claude AI model to streamline cyber‑espionage against Europe and Ukraine. Between…A short excerpt from our source record; open the original for the full article.
Available excerpt
Anthropic has published its most detailed threat intelligence report so far, and the picture it paints of how its Claude models are being misused is…A short excerpt from our source record; open the original for the full article.
First tracked by DoomRadar: . AI-assisted analysis · . Based on linked headlines and available excerpts. Methodology · Report an error.