According to a report by Anthropic, the Russian hacker group Midnight Blizzard used the Claude AI model to streamline cyber‑espionage against Europe and Ukraine. Between December 2025 and August 2026, this group attacked more than 20 different entities, including intelligence services, military bodies, defence contractors and diplomatic missions.
The AI was integrated into virtually every phase of the attack. It helped the hackers locate targets, gather intelligence, set up phishing networks and steal login credentials. Once inside a network, the AI facilitated lateral movement and the theft of hundreds of gigabytes of sensitive data.
In addition, the group used the AI to bypass security software; whenever an antivirus program flagged a malicious file, the AI analysed the detection trigger and rewrote the code until it could evade the defence systems.
A key focus of these operations was drone technology and the associated supply chain. The hackers breached military manufacturers of UAVs and suppliers of drone parts. In doing so, they stole e-mail archives and development tools for software used in drones.
By reverse‑engineering this stolen code over several days, the attackers uncovered hardware specifications, supplier lists, system architectures and details of products that had not yet been released.
The group also used creative methods to reach high‑value targets. By compromising three hotel Wi-Fi providers and modifying DNS records, they redirected hotel guests’ traffic to malicious servers to spread malware on iOS, Android and Windows devices.
They also hijacked WhatsApp accounts using a ‘headless’ browser platform based on the WPPConnect library. By disabling read receipts, they secretly downloaded vast quantities of correspondence from Ukrainian and Russian accounts, including those of former senior Ukrainian officials.
Other attacks targeted video surveillance systems. The hackers exploited API vulnerabilities in streaming services to steal authorisation tokens, giving them unauthorised access to live camera feeds.
The group also targeted entities in North Africa. There, the hackers broke into a technological government agency and stole a database containing identity data for 300,000 citizens and a commercial register with information on more than 500,000 companies.
These events fit into a broader pattern of Russian cyber activities. Reports from July showed that Russian agents had spent the previous year targeting US government officials, defence companies and specialists in the nuclear energy sector.
Business AM
Ltd
