Threat Overview
Anthropic’s September 2026 threat-intelligence report documented GTG-20006, a Russian state-nexus espionage actor whose attribution is consistent with public reporting on Midnight Blizzard. Anthropic observed AI-assisted workflows spanning malware development, infrastructure acquisition, phishing, persistence, command-and-control, credential theft, and exfiltration. Of particular defensive importance, AI agents monitored whether deployed tooling was detected and modified or rebuilt malware to restore evasion. Reporting also described browser credential theft, ClickFix-style delivery, DNS hijacking through compromised hospitality vendors, Microsoft 365 device-code phishing, and token abuse. More than 20 organizations were reportedly targeted across government, diplomatic, defense, intelligence, and foreign-policy sectors.
References
- Anthropic, Countering misuse of AI: September 2026.
- The Hacker News, September 11, 2026: Russian state-sponsored hackers use AI-assisted adaptive malware.
Impacted Systems
This is a campaign rather than a product-specific vulnerability. Relevant environments include Windows endpoints, Microsoft 365 identities, DNS infrastructure, phishing and hosting infrastructure, mobile devices, and cloud email. Observed delivery and access methods included phishing, ClickFix-style lures, compromised credentials, DNS hijacking, and device-code phishing. Objectives included browser credential theft, persistent C2, cloud token theft, email espionage, and exfiltration. No universal malware hash or infrastructure set applies because tooling was repeatedly rebuilt.
Why this matters
The campaign materially reduces the value of static IOC-only detection. Malware can be rebuilt rapidly when defenses detect it, making process behavior, credential access, identity anomalies, infrastructure changes, and post-compromise activity more durable hunting targets.
Exploitation Status
Confirmed observed state-nexus threat activity documented by Anthropic. This is operational campaign reporting, not a proof of concept.
What this hunt looks for
ClickFix-like shell execution, suspicious command-line references to browser credential stores, rapid hash churn, newly seen remote domains, DNS changes, device-code authentication, rapid sign-in IP rotation, scheduled-task persistence, security-control tampering, and Windows Security Event fallbacks.
Required logs
Microsoft Defender XDR endpoint telemetry, Entra SigninLogs, AzureActivity for Azure-hosted DNS changes, and Windows Security Event 4688 where endpoint process telemetry is unavailable.
First Pass – ClickFix-Style Shell Execution From Browser or Explorer
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","explorer.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp descUnexpected Command Lines Referencing Browser Credential Stores
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has_any ("Login Data","Local State","key4.db","logins.json","Cookies")
| where FileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,FileName,ProcessCommandLine,SHA256
| order by Timestamp descRapid Malware Rebuild Pattern – Same Name, Many Hashes
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where isnotempty(SHA256)
| summarize Hashes=dcount(SHA256),HashSet=make_set(SHA256,50),Executions=count(),Devices=dcount(DeviceId) by FileName
| where Hashes >= 5 and Executions >= 5
| order by Hashes descNewly Seen Remote Domains
let Baseline=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(2d))
| where isnotempty(RemoteUrl)
| summarize by RemoteUrl;
DeviceNetworkEvents
| where Timestamp >= ago(2d)
| where isnotempty(RemoteUrl)
| join kind=leftanti Baseline on RemoteUrl
| summarize FirstSeen=min(Timestamp),LastSeen=max(Timestamp),Connections=count(),Devices=dcount(DeviceId) by RemoteUrl
| order by FirstSeen descSuspicious DNS Resource Changes in Azure
AzureActivity
| where TimeGenerated >= ago(30d)
| where OperationNameValue has "DNS"
| where OperationNameValue endswith "/WRITE"
| project TimeGenerated,Caller,CallerIpAddress,OperationNameValue,ResourceGroup,ResourceId,ActivityStatusValue,CorrelationId
| order by TimeGenerated descDevice-Code Authentication Activity
SigninLogs
| where TimeGenerated >= ago(30d)
| where AuthenticationProtocol =~ "deviceCode"
| summarize FirstSeen=min(TimeGenerated),LastSeen=max(TimeGenerated),Attempts=count(),IPs=make_set(IPAddress,20),Countries=make_set(tostring(LocationDetails.countryOrRegion),20),Apps=make_set(AppDisplayName,20) by UserPrincipalName
| where Attempts >= 3
| order by LastSeen descRapid IP Rotation Against One Account
SigninLogs
| where TimeGenerated >= ago(7d)
| summarize Attempts=count(),DistinctIPs=dcount(IPAddress),IPs=make_set(IPAddress,50),Countries=make_set(tostring(LocationDetails.countryOrRegion),20) by UserPrincipalName,bin(TimeGenerated,1h)
| where DistinctIPs >= 5
| order by TimeGenerated descSuspicious Scheduled Task Creation
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has_any ("/create","/change")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,ProcessCommandLine
| order by Timestamp descSecurity Tool Tampering or Update Interference
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has_any ("Set-MpPreference","Add-MpPreference","DisableRealtimeMonitoring","wuauserv","UsoSvc","UpdateOrchestrator")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine
| order by Timestamp descSecurityEvent Fallback – Browser or Explorer Spawning Script Hosts
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName has_any ("chrome.exe","msedge.exe","firefox.exe","explorer.exe")
| where NewProcessName has_any ("powershell.exe","pwsh.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe")
| project TimeGenerated,Computer,Account,ParentProcessName,NewProcessName,CommandLine
| order by TimeGenerated descDetection Notes
Behavioral detections are more important than hash-only detection because the actor was observed rebuilding tooling when detected. New-domain and hash-churn hunts are intentionally broad. Device-code authentication is legitimate in some environments, so unexpected users, IPs, geographies, and follow-on access provide essential context. DNS-change visibility depends on an ingested DNS-management source. Without endpoint and identity telemetry, key parts of this campaign are not visible in Sentinel.
Killian Sherer 