Net Good IndexSubmit a correction

Harm Ledger · provisional · Safety

Russian-nexus operators use Claude to run espionage against Ukraine and European targets

Anthropic’s September 2026 threat report describes GTG-20006, a Russian-speaking actor it links to Midnight Blizzard tradecraft, using Claude-driven workflows to phish, persist, and exfiltrate data from more than 20 organizations concentrated in Ukraine and Europe, including government, diplomatic, and drone-supply-chain victims.

10 Sep 2026Tier 3 Major HarmMethodology 0.1

Current score

−0.96

10 base · Major Harm (tier 3 of 5, 10 pts)
× 0.5000 attribution · Material acceleration
× 0.5000 evidence · External expert evaluation
× 0.7000 realization · Independently validated or deployed
× 0.5500 durability
Event-level product before credit split: 0.96

Multi-victim state-nexus espionage with reported government and industrial theft is major harm (tier 3). Human-directed campaign with Claude orchestration (0.50). First-party threat intel without independent victim confirmation (0.50). Realization is reported completed collection, later disrupted (0.70).

What happened

Anthropic says the actor automated reconnaissance, phishing infrastructure, malware rebuilds after detection, mailbox theft, hotel-WiFi DNS hijacking, and WhatsApp companion-device collection. Reported impacts include bulk export of drone-manufacturer mail and a North African government credential database with hundreds of thousands of national identity records. Humans directed targeting; Claude executed much of the operational work. Anthropic says it disrupted the observed activity and shared intelligence with partners. This is AI-enabled espionage, not an autonomous state-scale war.

Model attribution

Claude
Version unspecified
−0.96

Claude

Claude models used to build, retune, and operate the actor’s phishing, malware, and exfiltration workflows.

Anthropic attributes material operational uplift to Claude Haiku/Sonnet/Opus; humans chose targets and remained in the loop.

Attribution 0.5000 · Credit share 100% · Anthropic

Claims

  • Anthropic reports a Claude-assisted Russian-nexus campaign that targeted more than 20 organizations, with a concentration on Ukraine and European government and drone-industry entities.

    outcome · supported

  • Claude independently selected Ukraine as a target without human operators.

    attribution · disputed

Sources

primary sources

Secondary domains: Public Infrastructure, Computer Science

Revision history

  • 13 Sep 2026 · 0.00 → 0.96

    Imported events under methodology 0.1.