Russia uses AI in cyberattacks against Ukraine, Europe, targeting WhatsApp accounts, government ministries, Anthropic says

Russia has been using Claude AI in cyberattacks against Ukraine and Europe in recent months, targeting various government ministries and the WhatsApp accounts of high-level officials, Anthropic said in a Sept. 10 report.

"The most commonly recurring targets were members of the Ukrainian government, military and diplomatic staff. The actor scanned email services and remote access systems across more than two dozen Ukrainian government organizations," the report read.

Russia has been able to use AI to circumvent defenses against cyberattacks that would be more costly for hackers to do so without the tool.

Russian state-sponsored hacking group Midnight Blizzard "increased their speed by automating their operations using AI" for an actor labelled as GTG-20006 by Anthropic.

"Our attribution is consistent with public reporting linking the actor to Midnight Blizzard. One of the operators is a Russian speaker using the handle 'JackPoterz' whose tradecraft and targeting are consistent with Russian state-nexus espionage," the report read.

Military intelligence targets in Ukraine and Europe, diplomatic and defense organizations, as well as individuals connected to U.S. foreign policy were attacked.

"The actor also took over victims' WhatsApp accounts, using a platform of headless browsers to link victim accounts as companion devices... the actor's configuration suppressed read receipts so victims would not notice while it bulk-exported Russian and Ukrainian language conversations. At least two former high-level Ukrainian officials were targeted in this way."

GTG-20006 used AI to track if known security defenses were evaded and would autonomously modify malware to circumvent existing detections, Anthropic said.

"Our investigation identified more than 20 distinct organizations targeted in the actor's operational planning, reconnaissance, and live operations. They included government ministries, defense and intelligence bodies, embassies and diplomatic missions, think tanks, and defense-industrial companies, concentrated in Ukraine and Europe but extending to the Middle East and maritime-related government agencies in Asia," the report read.

"A common theme of the targeting was Ukraine and military drone technology providers and supply chains."