Autopsy 22 · Nation-state operators, AI-native tradecraft

Would Ethosure have caught this? The Russian-linked operators that closed the loop on Claude

Anthropic disclosed a cyberespionage operation matching the tradecraft of the Russian state-nexus actor Midnight Blizzard, plus two tracked designations, GTG-50020 and GTG-50021, using Claude to automate malware evasion, run a fraudulent Claude reseller service, and mount a campaign against roughly 30 AI companies seeking access to a pre-release Claude model. Victims included Ukrainian and European ministries, defense and intelligence bodies, embassies, drone component manufacturers, and hospitality vendors. Ethosure treats stolen AI credentials as production credentials and treats a self-modifying malware loop as a workload boundary problem.

The incident

On September 10, 2026, Anthropic published a threat-intelligence report covering activity from December 2025 through August 2026. It named three actor lines. Midnight Blizzard, the Russian state-nexus actor, used Claude to monitor whether its malware was being detected by security products; when a tool was flagged, AI agents automatically modified it, rebuilt it, and redeployed until the malware went undetected again. Anthropic said this moves the cost of the detection-evasion cycle back onto defenders and lets attackers “close the loop.” More than 20 organizations were targeted, including Ukrainian and European government ministries, defense and intelligence bodies, embassies, and think tanks, with additional targeting in the Middle East and Asia. Two drone component manufacturers had mailboxes exfiltrated; one had its complete proprietary software development kit for a drone vision system stolen. At least three hospitality vendors operating hotel guest Wi-Fi were compromised using stolen administrator credentials and DNS hijacking; Microsoft documented the same delivery method in July under the name CaptiveCrunch. At least two former high-level Ukrainian officials were targeted through WhatsApp companion-device linking via headless browsers, with read receipts suppressed to hide the exfiltration. Separately, GTG-50021 ran a fraudulent Claude reseller service that silently proxied paying customers to a different model while a bundled client application harvested their Anthropic account credentials for resale. GTG-50020, a financially motivated Russian-speaking group with prior targeting of hotel-booking and fintech platforms, used prompt injection against an unnamed AI vendor’s automated evaluation sandbox to extract production API keys belonging to multiple providers, then launched a campaign against roughly 30 AI companies over several days pursuing more than a dozen avenues to reach a pre-release Claude model. Anthropic said none of those attempts succeeded.

• Anthropic – Threat intelligence report, September 2026
• SecurityWeek – Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion (Sep 10 2026)

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures – the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. Read the primary sources: Anthropic threat intelligence report and SecurityWeek. The Anthropic report is the more complete source; the SecurityWeek write-up is the readable summary.
2. The first expression is agent.artifact.self_modifying_evasion_loop_block. Any agent session that iteratively modifies, rebuilds, and redeploys a binary or script based on detection signals from security products must be classified against a permitted-purpose registry. Absent a signed workload lease that names an authorised red-team engagement, the loop stops. Severity block. This is the control that would have kept Claude out of the Midnight Blizzard modify-rebuild-redeploy cycle.
3. The second expression is ai_credentials.treated_as_production. AI API keys, reseller integrations, and agent identities must be issued, rotated, monitored, and revoked under the same lifecycle as production database and cloud-control-plane credentials. That means short-lived tokens, workload attestation on every issuance, anomaly detection on request patterns, and revocation on workload lease expiry. The GTG-50021 reseller theft and the GTG-50020 sandbox-key extraction both fail this control. Severity alert on drift, block on unattested reissuance.
4. The third expression is ai_vendor.evaluation_sandbox.prompt_injection_isolation. An AI vendor’s own automated evaluation sandbox must not hold production credentials for other providers in a context reachable by user-controlled prompts. GTG-50020’s initial technique was prompt injection that caused the sandbox to hand over multi-provider API keys. Severity block. The lesson is not that prompt injection exists; it is that a sandbox with production keys is a production system, and the perimeter has to match.

Policy YAML

# Pack: model / provider governance (v2)
# Overlay: nation-state threat model
principles:
  - id: ai-workload:artifact-purpose-and-credential-hygiene
    title: Artifact-purpose classification and AI-credential handling as production credentials
    direction: >-
      Agent sessions that iteratively modify malware-shaped artifacts
      require signed permitted-purpose leases. AI API keys and reseller
      integrations are treated as production credentials.
    skill_id: safe-ai-artifact-release
    policy:
      expressions:
        - id: agent.artifact.self_modifying_evasion_loop_block
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - ai-workload:artifact-purpose-and-credential-hygiene
            - workload-declared-lease
          when: >-
            tool_call.category in ["binary_write", "script_write",
                 "sandbox_deploy"]
            && session.artifact.iteration_count > 1
            && session.artifact.driven_by_detection_signal == true
            && !(session.workload_lease.permitted_purposes
                   .contains("authorised_red_team_engagement")
                 && session.workload_lease.approver_role == "security_leader")
          message: >-
            Agent session is iteratively modifying an artifact in
            response to security-product detection signals without a
            signed permitted-purpose lease for an authorised
            red-team engagement.
          advice: >-
            Halt the session. Require signed lease with approver_role
            security_leader, engagement_id, and target scope before
            resumption.
        - id: ai_credentials.treated_as_production
          scope: credential_lifecycle
          severity: alert
          event: CredentialInventoryScan
          principle_ids:
            - ai-workload:artifact-purpose-and-credential-hygiene
            - credential-hygiene
          when: >-
            credential.type in ["ai_api_key", "reseller_integration",
                 "agent_identity"]
            && (credential.max_ttl_hours > 24
                || credential.workload_attestation == null
                || credential.anomaly_detection == "not_enrolled"
                || credential.revocation_on_lease_expiry == false)
          message: >-
            AI credential is not managed under production credential
            lifecycle. Short-lived issuance, workload attestation,
            anomaly detection, and lease-tied revocation are required.
          advice: >-
            Rotate to short-lived issuance, enrol in anomaly detection,
            and tie revocation to workload lease expiry.
        - id: ai_vendor.evaluation_sandbox.prompt_injection_isolation
          scope: sandbox_configuration
          severity: block
          event: SandboxLaunch
          principle_ids:
            - ai-workload:artifact-purpose-and-credential-hygiene
            - sandbox-isolation
          when: >-
            sandbox.type == "ai_evaluation"
            && sandbox.accessible_from_user_prompt == true
            && sandbox.holds_credentials_for_other_providers == true
          message: >-
            AI evaluation sandbox holds production credentials for
            other providers in a context reachable by user-controlled
            prompts. That is a production system on a research
            perimeter.
          advice: >-
            Isolate provider credentials to a broker outside the
            user-prompt context. Require workload attestation on
            broker calls.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack – secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay – OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay – PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay – identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack – egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack – payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 17, 2026 · Ethosure · Part of the Autopsy Series.