# ReversingLabs: behavior beat hashes on an AI-assisted spy campaign

> Behavior-based hunting found implants that an actor rebuilt with Claude, while hashes and file names changed too fast to track.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Research
- **Published by:** ReversingLabs
- **Disclosed:** 2026-10-08
- **Affects:** Claude, Claude Code
- **Research by:** [Igor Lasic](https://www.reversinglabs.com/blog/anthropic-midnight-blizzard-what-reversinglabs-found-first)
- **Primary source:** https://www.reversinglabs.com/blog/anthropic-midnight-blizzard-what-reversinglabs-found-first
- **Page:** https://theinjection.dev/items/reversinglabs-gtg-20006-behavior-detection/

ReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.

## What happened

Igor Lasic, SVP of Technology at ReversingLabs, published the analysis on October 8, 2026. Anthropic's September 2026 threat intelligence report described GTG-20006, a Russian espionage actor whose attribution Anthropic says is consistent with public reporting linking it to Midnight Blizzard. ReversingLabs compared that report against its own historical telemetry.

## How it works

Anthropic states the actor built automated loops in which agents noticed when security products flagged their malware, then rewrote and redeployed it until it evaded detection. ReversingLabs reports that the loop changed hashes, build artifacts and file names but not the underlying behaviors. A hunt built on the operator's beacon behavior returned seven malicious files and no hits on clean software.

## Who is affected

Anthropic says the actor targeted more than 20 organizations, mainly Ukrainian and European government, military intelligence, diplomatic and defense bodies, along with Ukrainian drone technology suppliers. Anthropic reports the activity ran on its Claude Haiku, Sonnet and Opus models, with a human operator maintaining the Claude Code skills that drove the workflows.

## What to do

Hunt on behavior rather than on hashes wherever an actor can regenerate artifacts cheaply, and retain historical telemetry so a later report can be matched against files already seen. ReversingLabs notes that 13 of the 14 servers Anthropic listed looked low risk in third-party reputation sources, so reputation feeds alone would have missed that infrastructure.

## Quick facts

- **Actor:** GTG-20006, attribution consistent with Midnight Blizzard (Anthropic)
- **Anthropic report:** Detecting and countering misuse of AI, September 2026
- **First seen by RL:** Go backdoor July 6, PowerShell stager July 10, 2026
- **RL verdict:** Both classified malicious August 1, 2026
- **Behavior hunt:** 7 malicious files, no clean-software hits
- **Added indicators:** 7 files, 8 URLs, 2 infrastructure links absent from Anthropic's appendix
- **Reputation gap:** 13 of 14 listed servers looked low risk in third-party sources

## Questions

### Did Anthropic's report include all of GTG-20006's infrastructure?

ReversingLabs reports finding seven more files, eight more URLs and two links between the cluster's domains and servers that do not appear in Anthropic's appendix. ReversingLabs also says 13 of the 14 servers Anthropic did list looked low risk in third-party reputation sources. Defenders working only from the published appendix would therefore hold an incomplete indicator set.

### Did using Claude make the GTG-20006 malware harder to detect?

ReversingLabs concludes that Claude sped up how quickly the operator could rebuild flagged files but did not change what the malware did. Hashes, build artifacts and names shifted across five stager builds between July 9 and August 3, 2026, while beacon behavior stayed stable enough for a behavior-based hunt to recover seven malicious files.

### How much earlier did ReversingLabs see the GTG-20006 implants?

ReversingLabs says it first observed the Go backdoor on July 6, 2026 and the PowerShell stager on July 10, 2026, then classified both as malicious on August 1, 2026. Anthropic's threat intelligence report naming GTG-20006 followed in September 2026, roughly two months later. ReversingLabs presents the gap as evidence that historical telemetry carries detection value.

## Sources

1. [ReversingLabs Analysis](https://www.reversinglabs.com/blog/anthropic-midnight-blizzard-what-reversinglabs-found-first)
2. [Anthropic Threat Report](https://www.anthropic.com/threat-intelligence-report-september-2026)