AI Can Now Automate Entire Attack Chains

Threat actors can now use AI tools to automate entire attack operations, according to a new report from Anthropic.

The company says an attacker abused its Claude AI tool to create a hacking and extortion campaign that compromised at least seventeen organizations. The attacker used Claude to conduct reconnaissance, initial access, malware development, data exfiltration, and extortion analysis.

“A cybercriminal used Claude Code to conduct a scaled data extortion operation across multiple international targets in a short timeframe,” the researchers write. “This threat actor leveraged Claude’s code execution environment to automate reconnaissance, credential harvesting, and network penetration at scale, potentially affecting at least 17 distinct organizations in just the last month across government, healthcare, emergency services, and religious institutions.”

The attacker was able to steal “healthcare data, financial information, government credentials, and other sensitive information, with direct ransom demands occasionally exceeding $500,000.”

Anthropic also observed a Chinese state-sponsored APT abusing Claude to assist in a successful espionage campaign targeting Vietnamese critical infrastructure.

“The actor integrated Claude as an assistant across 12 of 14 MITRE ATT&CK tactics, using it as a technical advisor, code developer, security analyst, and operational consultant throughout their campaign,” the researchers write. “The actor appears to have compromised major Vietnamese telecommunications providers, government databases, and agricultural management systems.”

Additionally, the researchers observed AI-assisted attacks launched by North Korean and Russian APTs, as well as ransomware gangs, romance scammers, and malware developers.

Anthropic has banned the accounts associated with this activity and is working on ways to prevent such abuse in the future. However, organizations should expect attackers to continue to leverage AI in their operations, and these attacks will only grow more sophisticated as the technology improves.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 HRM+ platform to strengthen their security culture and reduce human risk.

Anthropic has the story.