MITRE ATT&CKcampaign

C0062 Anthropic AI-orchestrated Campaign

Published 2026-04-20 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2026-04-20

Description

The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The Anthropic AI-orchestrated Campaign was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the Anthropic AI-orchestrated Campaign, human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.

Related

Uses · MITRE ATT&CK (27)

  • T1699 Direct Prompt Injection technique
  • T1683 Generate Content technique
  • T1213.006 Databases sub-technique
  • T1588.007 Artificial Intelligence sub-technique
  • T1590.004 Network Topology sub-technique
  • T1592.002 Software sub-technique
  • T1592.004 Client Configurations sub-technique
  • T1595.001 Scanning IP Blocks sub-technique
  • T1595.002 Vulnerability Scanning sub-technique
  • T1584.004 Server sub-technique
  • T1587.004 Exploits sub-technique
  • T1588.002 Tool sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1552.001 Credentials In Files sub-technique
  • T1136.001 Local Account sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1046 Network Service Discovery technique
  • T1049 System Network Connections Discovery technique
  • T1078 Valid Accounts technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1087 Account Discovery technique
  • T1119 Automated Collection technique

References