Iran-linked operators used Anthropic's AI to build targeting files on U.S. warships

A Russia-linked hacking group utilized Claude, an AI agent, as part of an extensive espionage operation targeting Ukrainian government agencies, military drone manufacturers, and various organizations across Europe, as revealed by Anthropic in a report titled "Detecting and countering misuse of AI." This hacking operation aligns with public reports on Midnight Blizzard, a Russian state-backed cyberespionage campaign attributed to Russia's Foreign Intelligence Service (SVR) by both the U.S. and the UK.

The hacking group targeted over 20 organizations, predominantly in Ukraine and Europe, employing AI agents to carry out reconnaissance, phishing, system access, and data theft. The group's primary focus was Ukraine's drone industry, where they successfully extracted data from at least two drone component manufacturers, attacked a military drone producer, and stole a software development kit for a drone computer-vision system.

The hackers meticulously studied the stolen software, gaining insights into its architecture and components, including information about an unreleased product. AI agents played a crucial role in every stage of the attack, from identifying potential targets to executing commands and processing stolen data. The group's operator, who communicates in Russian under the handle JackPoterz, demonstrated a pattern typical of Russian state-backed cyberespionage efforts.

In addition to targeting Ukrainian entities, the hackers breached at least three hotel Wi-Fi networks, attempting to infect devices of hotel guests, particularly those connected to Ukraine, including government officials and drone manufacturers. Anthropic's report also disclosed that the hackers gained access to a government technology organization in a North African country, stealing over 300,000 national identity records and registry data for more than 500,000 companies.