Russian Hackers Used Claude AI to Target Ukraine

A report by Anthropic, the company behind Claude AI, reveals that hacking groups affiliated with Russian intelligence have been utilizing the AI tool to launch more frequent cyberattacks on Ukrainian and Western institutions over the past six months. These attacks, described as "multi-victim campaigns," once would have necessitated a large team of skilled operators and specialized knowledge.

One such group, identified as Midnight Blizzard, is a Russia-based threat actor backed by the US and UK governments as the Foreign Intelligence Service of the Russian Federation. Anthropic's report, published on September 10, attributes the targeting tactics of Midnight Blizzard to a Russian-speaking operator known as 'JackPoterz'. This individual's modus operandi aligns with Russian state-nexus espionage.

Midnight Blizzard's operations have been concentrated in Ukraine and Europe, but have also extended to the Middle East and Asia, targeting government ministries, defense and intelligence bodies, embassies, diplomatic missions, think tanks, and defense-industrial companies. The group has specifically targeted WhatsApp accounts of high-level officials, with Ukrainian government, military, and diplomatic staff being the most frequent victims.

The attacks involved scanning email services and remote access systems across over two dozen Ukrainian government organizations. A recurring theme was the targeting of Ukraine and military drone technology providers, as well as their supply chains. The report also expresses concern that as AI models continue to advance, more actors, from individual hackers to organized entities, will increasingly adopt AI frameworks to execute more sophisticated cyberattacks at a faster pace and on a larger scale.