The malware that rewrites itself until it can no longer be seen

For thirty years, antivirus defence has relied on a simple cycle. An attacker writes a tool; a vendor eventually analyses it and publishes a signature; the tool no longer gets through; the attacker has to write a new one. This cycle imposed a cost on the adversary, and that cost is what made defence worthwhile. The first case in the report's cyber chapter describes an actor that removed this cost.

The loop that closes itself #

The actor is referenced as GTG-20006. Anthropic's attribution is consistent with public reporting on the Russian espionage group known as Midnight Blizzard; one of the operators is Russian-speaking and works under an identifiable alias. Targets: Ukrainian and European military intelligence, ministries, embassies and diplomatic missions, think tanks, defence manufacturers, and people connected to US foreign policy. More than twenty distinct organisations were identified in planning, reconnaissance and ongoing operations, concentrated on Ukraine and Europe, with offshoots in the Middle East and as far as maritime agencies in Asia.

The toolbox, and its automatic recycling #

The report details the arsenal, and that matters for understanding what follows. It consists of two families of Windows implants, a mobile exploitation kit, a credential stealer targeting browser password stores, a phishing platform designed to imitate priority targets (typically government websites), and an administration console for managing compromised accounts. Nothing new in the list. What is new: in the report's words, “each of these tools was managed and re-tooled as needed during the cyber operations through AI-assisted workflows.”

The central mechanism comes down to three sentences in the report. The actor used AI to monitor how well its tools evaded known security products. If the monitoring agents detected that one of its deployed pieces of malware was being flagged by a security product, they set about modifying and recompiling it autonomously to evade existing detections. They were designed to iterate until the tool was no longer detected. Only then did the tool go into operation: staged on disposable hosting servers, to which victims' traffic was directed to fetch it.

The result of the above is that AI has inverted the cost back onto defenders. Previously, defenders might have been able to slow an attacker's operational tempo via the deployment of a new detection. Now, at least in theory, capable adversaries can “close the loop,” bypassing traditional security detections faster than defenders can develop and deploy them.

The detail that should send a chill down your spine #

Alongside its credential stealers, the same actor deployed companion payloads with full remote access capabilities. Their additional function: freezing the victim machine's security updates, so that new signatures published by vendors were never downloaded or run on the machine.

In other words: even if your antivirus vendor eventually produces the right signature, your machine will not receive it. The two halves of the setup complement each other: on one side the tool is rewritten until it gets through, on the other the countermeasure is prevented from ever arriving. This is an indicator of compromise in its own right, and one of the few within reach of any organisation: a machine whose security updates have stopped applying for three weeks, with no explanation, must be treated as suspect, not as a low-priority maintenance ticket. An IT estate where nobody can say which machines are up to date cannot produce this signal.

The ways in, meanwhile, remain ordinary #

There was nothing exotic about the way this actor got in. That matters, because this is where an SME's defence is decided: the innovation is in the evasion loop, not in the front door.

• Device code phishing. The main access technique abused the legitimate login flows of cloud e-mail services: the victim enters a code in good faith on a genuine Microsoft login page, and it is the attacker who receives the token. The actor had developed its own framework to run these token theft campaigns, and used AI to register the domains, configure hosting, send the e-mails and monitor successful compromises. Result: access to and exfiltration of e-mail at at least eight organisations, including a national public prosecutor's office, a military education institute and a regional intergovernmental organisation.
• Fake update lures. Windows credential stealers delivered under cover of an update to install, and lures of the “paste this command to fix your network” kind: the family of techniques known in the field as ClickFix, where the user runs the payload themselves.
• Hotel wifi. The actor compromised at least three providers that operate guest wifi for hotels. With stolen administration credentials, it changed DNS records to point to its own servers. Guests who connected saw their traffic, their device identifier and their network address go to the attacker, then received lures delivering Windows, Android and iOS malware. The actor then cross-referenced this data with customer information stolen from hotel management systems to refine its targeting. Microsoft published a report on this method in July 2026, which it calls CaptiveCrunch.
• Instant messaging accounts. Victims' accounts were linked as “companion devices” through a fleet of headless browsers, relying on an open-source automation library, with read receipts suppressed so that the victim noticed nothing, followed by bulk export of conversations in Russian and Ukrainian. At least two former senior Ukrainian officials were targeted this way.
• Camera services. The actor found authorisation flaws in the application interface of video streaming services, used them to enumerate users, and harvested the tokens giving access to victims' live camera feeds. No memory exploit, no system vulnerability: a badly written access control in an API.
• VPN credentials. At a North African government authority: stolen credentials for a VPN appliance, takeover of the central accounts server, then exfiltration of the complete database, with more than 300,000 national identity records and the business register of over half a million companies in the country.

The targets, and why they concern you #

You could read this list of victims and think that an accountancy firm in Sélestat interests nobody. Yet the report describes a pattern that should catch the attention of any industrial SME: the actor did not only target the end organisations, it worked its way up their supply chains. It scanned the e-mail and remote access services of more than two dozen Ukrainian government organisations, but its recurring secondary target was drone technology.

In practice: bulk export of the mailboxes of at least two drone component manufacturers, targeting of a military manufacturer, and theft of the complete, proprietary software development kit of an embedded vision system. The actor then spent several days reverse-engineering it, recovering the product's architecture, its hardware bill of materials, the list of its supplier dependencies, and details of an unannounced product. This is exactly the information a tier-two subcontractor holds about its prime contractor, and generally protects much less well than the prime contractor does.

The rule to draw from this is simple: your level of exposure does not depend on your size, it depends on what you hold about others. Drawings, bills of materials, remote access to a customer's systems, e-mail accounts shared with a prime contractor: each of these makes you a path, not a final target.

AI at every stage, as the report lists it #

The report does not just say that the actor “used AI”. It specifies where, and the list is instructive because it covers the entire chain, not just writing code.

• Reconnaissance: fingerprinting e-mail and remote access services, harvesting open-source information, building target lists for phishing.
• Initial access: building and running the platform that conducted the intrusion campaigns, setting up the phishing infrastructure and exploitation tooling, then directly executing parts of the intrusion: commands run against the victim's systems, credential harvesting, lateral movement through networks, under the operator's direction.
• Collection and exfiltration: extracting and organising hundreds of gigabytes of stolen data; in several cases, exfiltration went through bulk exports from compromised mailboxes.
• Maintaining access: automating the enrolment of attacker-controlled devices in the victim organisation's tenant. The report also mentions scheduled tasks that renewed stolen access tokens and harvested victims' cloud storage with no human involvement at all.
• On internal environments: monitoring the stealth and persistence of the implants; when they were flagged by a security product, systematically identifying, modifying and redeploying the detected artefacts.

And the human, in all this? The report is precise: “The human actor engaged primarily to modify Claude Code skills that drove the workflows when they needed to be refined.” The operator was not conducting the attack, but maintaining the machine that conducted it.

So what do we detect, and how? #

A file that changes shape with every compilation has no stable fingerprint. On the other hand, what it does remains remarkably constant, because that is dictated by the objective, not by the code. Recompiling an implant does not change the fact that it has to persist across reboots, talk to the outside world and get data out. Useful detection therefore shifts from “what does it look like” to “what does it do”. Here are the signals we instrument for our clients, and which an SME can put in place without an enterprise budget.

1. Centralised logs, away from the machine that produces them. This is the condition for everything else: an attacker who obtains administrator rights erases local logs. Ours are sent continuously to a dedicated collector.
2. Persistence. A scheduled task created, a startup key modified, a service installed, a systemd unit added. These are rare events in a stable IT estate; each one deserves a named alert.
3. Access. An SSH key added to an account, an administrator account created, an application token generated, a device enrolled in the directory. The case described above automated precisely the enrolment of attacker-controlled devices in the victim's tenant.
4. Outbound network traffic. A script process talking to an instant messaging API, a tunnel opening after a service is installed, an office workstation contacting a hosting provider it has never contacted before. The report lists this kind of behaviour as an indicator, without needing the file name.
5. Health of the defences. Antivirus disabled, updates blocked, monitoring agent silent for X hours. Given the companion payload described above, this is not hygiene: it is a detection in its own right. A silent agent is not good news.
6. Volumes. A mailbox export, access to thousands of objects in a few minutes, a query that reads an entire table. Bulk exfiltration leaves a bulk trace, and it is the one signal the attacker cannot remove, since it is the whole point of the operation.

This is exactly the job of a SIEM, and that is why we have deployed one across all our infrastructure; we will describe that integration in detail in a few days. One level down, Fail2Ban in production handles the background noise and feeds the same logs; and tooled patch management reduces the surface all this applies to, while also providing, incidentally, the list of machines that no longer update.

The inversion of cost, and what to do about it #

The report's conclusion should be read without dramatising it. It says that AI has inverted the cost back onto defenders, and that capable adversaries can close the evasion loop faster than the industry publishes its detections. It does not say that defence has become impossible. It says that defence by catalogue (one signature against one known threat) has lost its leverage.

The report also sets out two useful caveats. Autonomy and severity are two separate axes: autonomy multiplies scale and speed and brings costs down, but several of the most serious compromises in the report come from operations where a human directed every step. And humans kept what matters to them: target selection, reviewing results, monetisation. So this is not a race for a miracle tool.

What remains in your hands is therefore still the same three things, but their order of importance has changed. Reduce the ways in, because they have not moved: patches, second factor, unnecessary login flows turned off, few administrative accounts and all of them named. Watch behaviour rather than fingerprints, because fingerprints no longer hold. And be able to respond within hours, because that is the scale the adversary works at. An SME that holds these three lines is better placed than many organisations that have bought one more product.

Tomorrow: the French-speaking actor who got in through WordPress, hid a webshell in the font files, and poisoned the backups to survive restoration.

Sources #

• Anthropic, Detecting and countering misuse of AI: September 2026 (10 September 2026): Cyber operations chapter, GTG-20006 section Russian espionage: toolbox, autonomous evasion loop, frozen updates, ways in, targets and volumes, use of AI stage by stage.
• Same report: Prevailing trends section for the two caveats on autonomy and severity, and for the division of roles between human and model.
• Microsoft, on device code phishing and the captive portal hijacking campaign (CaptiveCrunch, July 2026), cited by the report.
• Previous instalments of the series: the overview, stolen API keys, the two-hour intrusion.
• Related articles: Fail2Ban in production, patch management, beyond the regional standard.