Russia-Linked Spies Had Claude Rebuild Their Malware Every Time It Got Caught, and It Still Gave Them Away

A Russia-linked espionage crew built something that sounded like the arrival of self-mutating AI malware. It wired Claude into a loop of AI agents that watched security tools, and whenever one of its implants got flagged, the agents rebuilt it until it slipped past detection again.

New research from ReversingLabs suggests the trick was less magic than it looked. The rebuilt malware had a new file signature every time, but it kept doing exactly the same things, and that behavior is how defenders kept finding it.

The loop Anthropic described

Anthropic first laid out the operation in its September threat report, where it tracks the actor as GTG-20006. The company said the group ran "customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration."

The most unsettling part was the rebuild cycle. Monitoring agents checked whether any deployed malware had been detected by a security product, and when it had, other agents would set about "autonomously modifying and rebuilding the malware to evade the existing detections," Anthropic wrote. They were designed to keep iterating "until it was undetected."

The campaign hit more than 20 government, diplomatic, think tank and defense organizations, focused on Ukrainian and European targets. Anthropic says the targeting and methods are consistent with public reporting on Midnight Blizzard, the group also known as APT29 and Cozy Bear.

Microsoft had described the same infrastructure on July 31 as CaptiveCrunch. It named a PowerShell stager called ChocoShell and a Go backdoor called CornFlake, and tied the work to Storm-2945, which it assesses as a sub-group of Midnight Blizzard. In Microsoft's account, compromised hotel and venue network portals sat early in the attack chain, pushing travelers to phishing pages and ClickFix prompts. The same crew went right back to hotel Wi-Fi login pages after that exposure.

Five disguises, one behavior

ReversingLabs, in a report published Oct. 15, found five more ChocoShell builds spread over 25 days, from July 9 to Aug. 3. Each had a different hash. All five shared the same 35-item behavior profile.

Some code changes were enough to break fuzzy-hash matching, but the beacon labels the operators chose survived every version. A YARA search built on those labels and the scripts' PowerShell actions turned up seven malicious scripts, including the original. Two tiny 60-byte shortcut files pointed at the staging server, and none of 37 antivirus engines flagged them. The server was still handing out malicious files during checks on Oct. 5.

CornFlake reads browser profiles and Microsoft Teams cache data, persists through a registry startup entry and scheduled tasks, and showed signs of keylogging.

The firm is careful about what it can prove. Its file analysis does not independently confirm who the actor is, and it cannot tell from its own records whether AI produced the five stager versions. It held the files from July 6 and July 10 but classified them as malicious on Aug. 1, the day after Microsoft's report.

Igor Lasic, SVP of engineering at ReversingLabs, told CSO Online the case is the "clearest one on record" because Microsoft and Anthropic independently described the same infrastructure. His explanation for why the disguises failed is economic. "Today a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims," he said, so the indicators that survived "were the ones that had to change in two places at once."

The underlying logic does not change either. "An implant that steals credentials has to read the credential store and one that calls home has to open a connection, whatever built it," Lasic said.

Ben Bernstein, who manages the cybersecurity advisors team at Huntress, saw the same pattern. "What stands out with this Midnight Blizzard activity is outsourcing the busywork to an LLM," he said. "The packaging looks different, but the payload's core objective remains exactly the same." The attackers, he added, "remix known patterns rather than dreaming up zero-days."

The gap may not last

None of this is entirely new. Google documented PromptFlux in late 2025, an experimental script that asked Gemini to rewrite its own source every hour, along with PromptSteal, which APT28 used against Ukraine. In March, Microsoft described the North Korean cluster Coral Sleet using agentic AI tools to generate, test and deploy payloads.

Lasic expects the defenders' advantage to narrow. "A more capable agent with access to the whole operation could coordinate those changes," he said, predicting that infrastructure indicators will age faster over the next few years, the way hashes already have.

For now, though, speed cuts both ways. "Rebuilding faster produces more artefacts," Lasic said, "and each one is another thread back to the operation."

Some offers on this page may be paid placements or contain affiliate links.