{"data":{"event":{"id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","slug":"claude-gtg20006-ukraine-europe-espionage","title":"Russian-nexus operators use Claude to run espionage against Ukraine and European targets","short_summary":"Anthropic’s September 2026 threat report describes GTG-20006, a Russian-speaking actor it links to Midnight Blizzard tradecraft, using Claude-driven workflows to phish, persist, and exfiltrate data from more than 20 organizations concentrated in Ukraine and Europe, including government, diplomatic, and drone-supply-chain victims.","full_description":"Anthropic says the actor automated reconnaissance, phishing infrastructure, malware rebuilds after detection, mailbox theft, hotel-WiFi DNS hijacking, and WhatsApp companion-device collection. Reported impacts include bulk export of drone-manufacturer mail and a North African government credential database with hundreds of thousands of national identity records. Humans directed targeting; Claude executed much of the operational work. Anthropic says it disrupted the observed activity and shared intelligence with partners. This is AI-enabled espionage, not an autonomous state-scale war.","ledger_type":"harm","primary_domain_id":"8b844c0d-c1ac-4f54-920a-34321e45582d","event_status":"provisional","event_date":"2026-09-10T00:00:00.000Z","discovery_date":"2026-09-10T00:00:00.000Z","first_published_date":"2026-09-10T00:00:00.000Z","last_reviewed_date":"2026-09-10T00:00:00.000Z","geographic_scope":"Ukraine, Europe, and additional government targets reported by Anthropic","affected_population":"More than 20 targeted organizations, including Ukrainian government and drone-industry staff as reported","base_impact_tier":3,"base_score":"10.00","attribution_multiplier":"0.5000","evidence_multiplier":"0.5000","realization_multiplier":"0.7000","durability_multiplier":"0.5500","current_event_score":"0.962500","confidence_level":"medium","score_explanation":"Multi-victim state-nexus espionage with reported government and industrial theft is major harm (tier 3). Human-directed campaign with Claude orchestration (0.50). First-party threat intel without independent victim confirmation (0.50). Realization is reported completed collection, later disrupted (0.70).","methodology_version_id":"d7881163-fb23-4e71-8625-bac1a8662c0f","original_methodology_version_id":"d7881163-fb23-4e71-8625-bac1a8662c0f","published_at":"2026-09-10T00:00:00.000Z","created_at":"2026-09-13T23:22:50.724Z","updated_at":"2026-09-13T23:22:50.724Z","flags":[],"domain_name":"Safety","domain_slug":"safety","methodology_version":"0.1"},"contributions":[{"id":"315f5f92-cb9a-4fed-9bae-c5405a63ef8f","event_id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","model_id":"059c33b6-fc2e-4d3d-acdb-c0d966ee5e6e","role_description":"Claude models used to build, retune, and operate the actor’s phishing, malware, and exfiltration workflows.","attribution_multiplier":"0.5000","credit_share":"1.0000","contribution_score":"0.962500","attribution_rationale":"Anthropic attributes material operational uplift to Claude Haiku/Sonnet/Opus; humans chose targets and remained in the loop.","attribution_confidence":"medium","first_used_date":"2025-12-01T00:00:00.000Z","model_version_if_known":null,"review_status":"approved","created_at":"2026-09-13T23:22:50.724Z","model_slug":"claude","model_name":"Claude","identity_class":"unknown","is_internal":false,"family_name":"Claude","family_slug":"anthropic-claude","organization_name":"Anthropic","organization_slug":"anthropic"}],"sources":[{"id":"05fde1d4-01fe-45c4-945f-d560620b4f71","event_id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","url":"https://www.anthropic.com/threat-intelligence-report-september-2026","canonical_url":"https://www.anthropic.com/threat-intelligence-report-september-2026","source_type":"developer_announcement","publisher":"Anthropic","author":null,"publication_date":"2026-09-10T00:00:00.000Z","retrieved_at":"2026-09-13T23:22:50.724Z","title":"Countering misuse of AI: September 2026","excerpt":null,"content_hash":null,"source_reliability_class":"low","is_primary_source":true,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-13T23:22:50.724Z"}],"claims":[{"id":"ae1f5bd1-ed46-4a11-9695-5aa50b0bd391","event_id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","claim_text":"Anthropic reports a Claude-assisted Russian-nexus campaign that targeted more than 20 organizations, with a concentration on Ukraine and European government and drone-industry entities.","claim_type":"outcome","claim_status":"supported","confidence_score":null,"created_at":"2026-09-13T23:22:50.724Z","updated_at":"2026-09-13T23:22:50.724Z"},{"id":"67f0631b-8838-43f5-9db5-1c54bf7bf9cc","event_id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","claim_text":"Claude independently selected Ukraine as a target without human operators.","claim_type":"attribution","claim_status":"disputed","confidence_score":null,"created_at":"2026-09-13T23:22:50.724Z","updated_at":"2026-09-13T23:22:50.724Z"}],"revisions":[{"id":"bfe4dfa0-77d3-4cbe-b7e9-71417e81100e","event_id":"556de9f6-5fb6-4ae3-aa58-b55f1078f9d6","model_id":null,"previous_score":"0.000000","new_score":"0.962500","previous_factors":{},"new_factors":{"evidence":0.5,"base_score":10,"durability":0.55,"attribution":0.5,"realization":0.7},"change_reason":"Imported events under methodology 0.1.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-13T23:22:50.724Z"}],"secondary":[{"name":"Public Infrastructure","slug":"public-infrastructure"},{"name":"Computer Science","slug":"computer-science"}]},"methodology_version":"0.1"}