Anthropic AI-orchestrated Campaign

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The Anthropic AI-orchestrated Campaign was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the Anthropic AI-orchestrated Campaign, human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2025-09-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2025-09-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2025-09-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1190 · Exploit Public-Facing Application

  Initial Access — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to deploy a custom exploit payload targeting an identified SSRF vulnerability to gain initial access to a targeted environment.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1699 · Direct Prompt Injection

  Execution — During the Anthropic AI-orchestrated Campaign, the adversary entered a prompt that claimed the user was an employee of a cybersecurity firm and that Claude was being used for defensive cybersecurity testing to authorize restricted operations.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1588.002 · Tool

  Resource Development — During the Anthropic AI-orchestrated Campaign, the adversary obtained open-source penetration testing tools including network scanners, database exploitation frameworks, password crackers, and binary analysis suites.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1588.007 · Artificial Intelligence

  Resource Development — During the Anthropic AI-orchestrated Campaign, the adversary obtained access to Claude Code to support cyber intrusion operations.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1136.001 · Local Account

  Persistence — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to create a local backdoor account to maintain access.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1592.002 · Software

  Reconnaissance — During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to catalog services and data on discovered endpoints.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1590.004 · Network Topology

  Reconnaissance — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map a complete network topology of the target infrastructure.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1083 · File and Directory Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to identify sensitive data within the victim environment for extraction.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1074.001 · Local Data Staging

  Collection — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to stage extracted data and operational documentation in structured markdown files on local systems prior to exfiltration.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1595.002 · Vulnerability Scanning

  Reconnaissance — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan target infrastructure to identify potential vulnerabilities and to enumerate services and endpoints.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1087 · Account Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal database user account tables to enumerate accounts and identify high-privilege accounts within compromised environments.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1587.004 · Exploits

  Resource Development — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to research exploitation techniques for an identified SSRF vulnerability, to generate a tailored custom attack payload, and to develop a full exploit chain prior to deployment.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1552.001 · Credentials In Files

  Credential Access — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to extract authentication certificates stored in system configuration files across compromised environments.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1567 · Exfiltration Over Web Service

  Exfiltration — During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to generate a detailed summary report of collected data, which is then reviewed and approved by the adversary prior to exfiltration of data over Claude.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1595.001 · Scanning IP Blocks

  Reconnaissance — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan infrastructure across IP ranges associated with the target organization.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1046 · Network Service Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to enumerate internal network services and endpoints across targeted environments using browser automation via MCP, including databases, container registries, admin interfaces, and workflow orchestration platforms.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1078.003 · Local Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to test credentials harvested against discovered devices.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1584.004 · Server

  Resource Development — During the Anthropic AI-orchestrated Campaign, the adversary operated dedicated penetration testing servers accessible via MCP to support remote command execution, simultaneous tool coordination, and persistent operational state maintenance across campaign sessions.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1213.006 · Databases

  Collection — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal databases and systems to extract proprietary information, system configurations, and sensitive operational data. (Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1016 · System Network Configuration Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1119 · Automated Collection

  Collection — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to automatically collect and process large volumes of data from without human direction.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1683 · Generate Content

  Resource Development — During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to automatically generate comprehensive documentation throughout the phases of the attack, including discovered services, harvested credentials, sensitive data, exploitation techniques, and complete attack progression.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1592.004 · Client Configurations

  Reconnaissance — During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to gather details of high-value systems to include databases and workflow orchestration platforms.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1005 · Data from Local System

  Collection — During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to automatically gather sensitive data stored within the local system to include credentials, system configurations and sensitive operational data.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1082 · System Information Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to query databases and systems in order to identify proprietary information, including system configurations and database types.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

• T1049 · System Network Connections Discovery

  Discovery — During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map internal network architecture and access relationships.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0062

  Official MITRE ATT&CK campaign record C0062. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.