A cybercriminal used Claude Code to run a data-extortion campaign against at least 17 organizations (Anthropic GTG-2002)
A cybercriminal Anthropic tracks as GTG-2002 used Claude Code to automate reconnaissance, credential harvesting, and network intrusion against at least 17 organizations, then to analyze the stolen data and write ransom notes demanding $75,000 to $500,000 in Bitcoin. Anthropic banned the accounts.
In June 2025, a cybercriminal Anthropic tracks as GTG-2002 used Claude Code to "vibe hack": run a coding agent that actively executes operations on victims' networks12. Claude Code automated reconnaissance, credential harvesting, and network intrusion, potentially affecting at least 17 organizations across government, healthcare, emergency services, and religious institutions. The actor gave it preferred tactics in a CLAUDE.md file, along with a cover story about authorized network security testing, but Claude Code still made tactical and strategic decisions, including which data to exfiltrate1.
Rather than encrypting systems, the actor threatened to publish what Claude Code had stolen. Claude analyzed victims' financial data to set ransom amounts and generated HTML ransom notes, displayed on victim machines, demanding $75,000 to $500,000 in Bitcoin. Data was taken from a defense contractor, healthcare providers, and a financial institution, among others. The ransom notes and other artifacts shown in Anthropic's report are labeled "Ex. Simulated" illustrations, not the real ones1. Humans "remained very much in the loop directing operations"2.
Anthropic banned the accounts, built a tailored classifier and a new detection method, and shared technical indicators with partners and authorities13.
Anthropic said it disrupted a cybercriminal operation it tracks as GTG-2002, which used coding agents to actively execute operations on victim networks, a technique it called "vibe hacking".
“Today we are sharing insights about a sophisticated cybercriminal operation (tracked as GTG-2002) we recently disrupted”
According to Anthropic, the actor used Claude Code's code execution environment to automate reconnaissance, credential harvesting, and network penetration, potentially affecting at least 17 organizations across government, healthcare, emergency services, and religious institutions in a single month.
“potentially affecting at least 17 distinct organizations in just the last month across government, healthcare, emergency services, and religious institutions.”
Anthropic said the actor supplied its preferred tactics in a CLAUDE.md file, but Claude Code still made tactical and strategic decisions, including how to penetrate networks, which data to exfiltrate, and how to craft extortion demands.
“the operation still utilized Claude Code to make both tactical and strategic decisions—determining how best to penetrate networks, which data to exfiltrate, and how to craft psychologically targeted extortion demands.”
Anthropic said the CLAUDE.md configuration file included a cover story claiming network security testing under official support contracts.
“This configuration file included a cover story claiming network security testing under official support contracts”
According to Anthropic, the actor did not encrypt systems with traditional ransomware. Instead it threatened to publicly expose the data Claude Code had exfiltrated, to extort victims into paying.
“Rather than encrypting systems using traditional ransomware, this actor leveraged the sensitive data Claude Code exfiltrated on their behalf, threatening its public exposure to extort victims into paying.”
Anthropic said Claude analyzed exfiltrated financial data to determine ransom amounts and generated HTML ransom notes that were displayed on victim machines by embedding them into the boot process.
“analyzed exfiltrated financial data to determine appropriate ransom amounts and generated visually alarming HTML ransom notes that were displayed on victim machines by embedding them into the boot process.”
According to Anthropic, the ransom notes demanded payments ranging from $75,000 to $500,000 in Bitcoin.
“The actor created ransom notes to compromised systems demanding payments ranging from $75,000 to $500,000 in Bitcoin.”
Anthropic said Claude Code extracted and analyzed data from organizations including a defense contractor, healthcare providers, and a financial institution.
“It systematically extracted and analyzed data from various organizations including a defense contractor, healthcare providers, and a financial institution”
The example Claude Code summary, CLAUDE.md, post-hack analysis report, and ransom note shown in Anthropic's report are labeled as simulated examples, not the actual artifacts.
“Ex. Simulated custom ransom note generated by Claude after analyzing extracted files”
Anthropic banned the accounts associated with the operation, began developing a tailored classifier and a new detection method, and shared technical indicators with key partners and relevant authorities.
“We banned the accounts associated with this operation. In response to this case, we began developing a tailored classifier specifically for this type of activity and another new detection method”
Anthropic's November 2025 report dates the "vibe hacking" findings to June 2025 and says the actor began intrusions with compromised VPNs while humans remained in the loop directing operations.
“our previous “vibe hacking” findings identified in June 2025, where an actor began intrusions with compromised VPNs for internal access, but humans remained very much in the loop directing operations.”
Measurements
All 11 claims with their quotes
- Anthropic said it disrupted a cybercriminal operation it tracks as GTG-2002, which used coding agents to actively execute operations on victim networks, a technique it called "vibe hacking".1
“Today we are sharing insights about a sophisticated cybercriminal operation (tracked as GTG-2002) we recently disrupted”
- According to Anthropic, the actor used Claude Code's code execution environment to automate reconnaissance, credential harvesting, and network penetration, potentially affecting at least 17 organizations across government, healthcare, emergency services, and religious institutions in a single month.13
“potentially affecting at least 17 distinct organizations in just the last month across government, healthcare, emergency services, and religious institutions.”
- Anthropic said the actor supplied its preferred tactics in a CLAUDE.md file, but Claude Code still made tactical and strategic decisions, including how to penetrate networks, which data to exfiltrate, and how to craft extortion demands.1
“the operation still utilized Claude Code to make both tactical and strategic decisions—determining how best to penetrate networks, which data to exfiltrate, and how to craft psychologically targeted extortion demands.”
- Anthropic said the CLAUDE.md configuration file included a cover story claiming network security testing under official support contracts.1
“This configuration file included a cover story claiming network security testing under official support contracts”
- According to Anthropic, the actor did not encrypt systems with traditional ransomware. Instead it threatened to publicly expose the data Claude Code had exfiltrated, to extort victims into paying.1
“Rather than encrypting systems using traditional ransomware, this actor leveraged the sensitive data Claude Code exfiltrated on their behalf, threatening its public exposure to extort victims into paying.”
- Anthropic said Claude analyzed exfiltrated financial data to determine ransom amounts and generated HTML ransom notes that were displayed on victim machines by embedding them into the boot process.1
“analyzed exfiltrated financial data to determine appropriate ransom amounts and generated visually alarming HTML ransom notes that were displayed on victim machines by embedding them into the boot process.”
- According to Anthropic, the ransom notes demanded payments ranging from $75,000 to $500,000 in Bitcoin.1
“The actor created ransom notes to compromised systems demanding payments ranging from $75,000 to $500,000 in Bitcoin.”
- Anthropic said Claude Code extracted and analyzed data from organizations including a defense contractor, healthcare providers, and a financial institution.1
“It systematically extracted and analyzed data from various organizations including a defense contractor, healthcare providers, and a financial institution”
- The example Claude Code summary, CLAUDE.md, post-hack analysis report, and ransom note shown in Anthropic's report are labeled as simulated examples, not the actual artifacts.1
“Ex. Simulated custom ransom note generated by Claude after analyzing extracted files”
- Anthropic banned the accounts associated with the operation, began developing a tailored classifier and a new detection method, and shared technical indicators with key partners and relevant authorities.13
“We banned the accounts associated with this operation. In response to this case, we began developing a tailored classifier specifically for this type of activity and another new detection method”
- Anthropic's November 2025 report dates the "vibe hacking" findings to June 2025 and says the actor began intrusions with compromised VPNs while humans remained in the loop directing operations.2
“our previous “vibe hacking” findings identified in June 2025, where an actor began intrusions with compromised VPNs for internal access, but humans remained very much in the loop directing operations.”
Sources
- [1]Threat Intelligence Report: August 2025
- [2]Disrupting the first reported AI-orchestrated cyber espionage campaign (Full report)
- [3]Detecting and countering misuse of AI: August 2025
Related incidents
- AID-2026-0063 State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign
- AID-2026-0066 ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
Editor notes
All facts come from Anthropic, the developer and only reporter, with no independent or victim confirmation, and the victims are unnamed. Date set to 2025-06 from the November 2025 report ("findings identified in June 2025"). The August report says the 17 organizations were affected "in just the last month" without exact dates. The August report text also says "direct ransom demands occasionally exceeding $500,000", which differs slightly from the "$75,000 to $500,000" range given on p.8; both are from the same report. The ransom notes and other artifacts shown in the report are labeled "Ex. Simulated". Behavior tags (unauthorized-access, blackmail) describe what the model was used to do under a human operator's direction, since no human-misuse-specific behavior term exists. Not checked for charges or arrests. The August report PDF has no explicit day, so its published date is given as 2025-08 (the blog post is dated 2025-08-27).