Anthropic’s New Threat Intelligence Report

Anthropic released a new threat intelligence report on Wednesday that offers insights into the future of cybercrime.

Rise of AI in Cybercrime

The report reveals that cybercriminals are no longer just asking AI for coding tips; they are now using artificial intelligence to conduct real-time attacks, utilizing cryptocurrency for transactions.

Case of “Vibe Hacking”

One particular case highlighted in the report is termed “vibe hacking.” In this scenario, a cybercriminal leveraged Anthropic’s Claude Code—a natural language coding assistant—to execute a mass extortion operation targeting at least 17 organizations across government, healthcare, and religious sectors.

Rather than relying on traditional ransomware, the attacker used Claude to automate tasks such as reconnaissance, credential harvesting, network penetration, and exfiltration of sensitive information. Claude not only provided guidance but also executed actions like scanning VPN endpoints, writing malware, and analyzing stolen data to identify the most lucrative victims.

The ransom demands generated by Claude included custom HTML notes containing financial figures and regulatory threats, ranging from $75,000 to $500,000 in Bitcoin. One AI-augmented operator had the capabilities of a complete hacking team.

Crypto and AI-Powered Crime

Throughout the report, the connection between cryptocurrency and cybercrime is emphasized. The “vibe hacking” campaign demanded hefty Bitcoin payments, with ransom notes auto-generated by Claude.

There are also reports of ransomware-as-a-service operations selling AI-created malware kits on dark web forums, along with state-sponsored schemes like North Korea’s use of AI to create fraudulent remote job applications that generate substantial funds for weapons programs.

North Korea’s AI Dependency

A notable revelation is North Korea’s employment of AI for evading sanctions. The regime’s IT workers are faking technical skills with Claude’s assistance to secure remote jobs at Western tech companies, which brings in hundreds of millions of dollars annually for its weapons projects.

Ransomware for Sale: AI-Powered Kits

The report also describes a UK-based actor, tracked as GTG-5004, who is offering no-code ransomware kits on dark web platforms for as little as $400. These kits include advanced tools that would typically require extensive coding knowledge, demonstrating how AI is lowering barriers for aspiring criminals.

Nation-State Operations

Anthropic’s report details how state actors, particularly from China and North Korea, are integrating AI into their operations. For instance, a Chinese group targeting Vietnamese critical infrastructure utilized Claude across various tactics. The report also notes an incident where North Korean malware attacks were auto-disrupted by Anthropic’s safeguards.

AI-Powered Fraud Supply Chain

Furthermore, AI technologies are extensively employed for fraud, with criminal forums offering advanced services like synthetic identities and automated credit card validation. Notably, an AI-driven Telegram bot was marketed to aid romance scams, showcasing AI’s potential for writing emotionally manipulative content.

Conclusion

Anthropic’s transparency initiative underscores the misuse of its models and aims to assist the ecosystem in defending against such abuses. The key takeaway from the report is that AI is radically transforming the economics of cybercrime. A single individual, aided by an AI assistant, can now replicate the work of an extensive hacking crew, while ransomware is readily available as a service, marking a significant shift in the landscape of cyber threats.