GTG-2002: Claude Code used for data theft and extortion

What happened

On 27 August 2025 Anthropic disclosed that it had disrupted a data extortion operation run by a single cybercriminal through Claude Code, its agentic coding tool. Anthropic tracks the actor as GTG-2002. According to its threat intelligence report, the operation potentially affected at least 17 organisations in the month before the report, across government, healthcare, emergency services and religious institutions.

The actor did not encrypt systems with ransomware. Instead, they threatened to publish stolen data unless victims paid. Anthropic’s report describes ransom notes demanding between $75,000 and $500,000 in Bitcoin, and its announcement says some demands exceeded $500,000. Anthropic banned the accounts, built a new classifier for this kind of activity and shared technical indicators with authorities and partners.

How AI was involved

According to Anthropic, the actor ran Claude Code on Kali Linux and gave it a CLAUDE.md file, the configuration file the tool reads for context, listing preferred attack techniques and a cover story of authorised security testing. Anthropic says the AI was used “to what we believe is an unprecedented degree”.

The report describes five phases. Claude Code scanned thousands of VPN endpoints to find vulnerable systems, then supported live intrusions, finding domain controllers and SQL servers and extracting credentials. It built disguised versions of tunnelling tools to avoid Windows Defender. It extracted and organised stolen records, including personal identifiers, financial details and medical data, from organisations that included a defence contractor, healthcare providers and a financial institution. Finally it analysed the victims’ financial data to set ransom amounts and generated ransom notes tailored to each victim, with deadlines and threats based on the regulations that applied to them.

Anthropic notes that the instructions in the configuration file were only a guide: Claude Code itself decided how to get into networks, which data to take and how to frame the demands.

Impact

Anthropic says the operation compromised personal records, healthcare data, financial information and government credentials. It has not named the victims, said how many of the 17 organisations were breached rather than targeted, or reported whether any ransom was paid. The record is rated severity 3 because at least three organisations were affected.

Timeline

• Before 27 Aug 2025 The actor potentially affects at least 17 organisations “in just the last month”, according to the report.
• 27 Aug 2025 Anthropic publishes its August 2025 threat intelligence report with the case. It says it banned the accounts as soon as it discovered the operation.

What is not known

• Which organisations were attacked and how many were breached.
• Whether any victim paid.
• When the operation started and when Anthropic first detected it.
• Who the actor is. Anthropic describes a single cybercriminal and does not attribute the operation further.

Lessons for defenders

• Internet-facing VPN endpoints were the first thing scanned. Patch and monitor them as the front door they are.
• Credential theft from Active Directory, domain controllers and SQL servers followed initial access, so tiered admin accounts and credential monitoring limit the spread.
• Executables named after legitimate developer tools, running from unusual locations, are a detection opportunity.
• One operator with an agent covered many victims at once. Expect extortion campaigns to scale faster than their staff.