Threat Intelligence
Anthropic published its latest threat intelligence report, covering activity it identified and disrupted between December 2025 and August 2026. Most of the coverage has focused on the scale of the campaigns. The finding that should change how security teams operate is smaller, more specific, and sits in the section on a Russian espionage actor.
The short version: the adversary's opening move was to evade the host. That single fact rules out any validation approach that asks the endpoint whether the endpoint was compromised, and it is why visibility has to be measured on the host and on the network, with a logged, alerted, or blocked verdict on both sides.
The Finding
Anthropic tracks the actor as GTG-20006, with attribution consistent with public reporting that links the activity to Midnight Blizzard. One operator used the handle "JackPoterz," and the targeting followed Russian state-nexus espionage patterns against Ukrainian and European government, diplomatic, and defense organizations.
The actor maintained a custom toolkit: two families of Windows implants, a mobile exploitation kit, a credential stealer targeting browser password stores, a phishing platform built to mimic government organizations, and an administrative console for managing compromised accounts. None of that is new. Espionage actors have always built custom tooling.
What is new is what they did with it. The actor used AI agents to monitor how well their tools were evading known security defenses. When the monitoring agents identified that a deployed piece of malware had been caught by a security product, the agents autonomously modified and rebuilt that malware to evade the detection, and were designed to keep iterating until the toolkit came back clean. Only then were the tools staged for live operations from disposable hosting servers.
The human operator's main job was refining the workflows that drove the loop.
They did not stop at evasion. Companion payloads delivered alongside the credential stealers were designed to freeze the victim machine's security updates, so new detection signatures published by security vendors would never be retrieved or run on that host. The control was still installed. It was simply frozen in time, and nothing on the dashboard would say so.
The Cost Inversion
Anthropic draws the conclusion for us, and it is worth sitting with. Historically, defenders imposed cost on adversaries through detection. An actor deployed a custom tool, defenders eventually identified it and built a signature, and the actor had to start a new cycle of development. Robust detections meant real cost and real delay for the attacker.
Anthropic's assessment is that capable adversaries can now "close the loop," bypassing traditional security detections faster than defenders can develop and deploy them. They describe the result as AI inverting cost back onto the defender.
Anthropic Threat Intelligence, September 2026
Read that as an operational statement, not a rhetorical one. Your detection engineering pipeline runs on human review cycles, change control, and release windows. Theirs runs on an agent loop with no human in it until the artifact comes out clean.
Point-in-Time Testing Is Now Structurally Behind
If an adversary is continuously re-testing your controls, then testing your controls once a year is not a security program. It is a snapshot of a system that is being actively worked against in the interval. A detection that passed your annual pentest is being re-tested by the adversary every week between assessments.
Three further findings from the same report make the case concrete.
Your Detection Stack Is Itself a Research Target
A separate cluster, tracked as GTG-10007 and run by Chinese-speaking operators, maintained an autonomous vulnerability research program. Its centerpiece was sustained research against a major security product, specifically a class of software deployed to detect intrusions. That effort produced multiple previously unknown vulnerabilities validated in the actor's own lab, along with working exploits for several families of network and security appliances. One workflow iterating continuously on network appliances produced more than a dozen possible zero-day findings in a single month.
Your Response Window Is Hours
In the financially motivated clusters Anthropic disrupted, the operational tempo was measured against the clock, not the calendar.
|
~3 hrs
From one stolen developer token to full administrative control of a victim cloud environment
|
~34 hrs
To dump over 2,100 Azure AD token sets across more than 40 corporate tenants, with AI agents doing nearly all of the work
|
~200
Downstream customer organizations reached from a single compromised SaaS provider
|
One breach of an enterprise software company took only hours from first access to bulk data theft. Anthropic summarizes the pattern as breaches completed in two to three hours, with dozens of victims handled in parallel by individual operators.
The Techniques Are Already Known
This is the part defenders should find clarifying rather than discouraging. Anthropic is explicit that none of the operations in the report depended on an entirely novel technique. The attacks involved stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing. What changed is the economics. Reconnaissance, exploitation, tool development, and data processing are now delegated to models running in harnesses at machine speed and in parallel.
You are not being asked to detect the unknowable. You are being asked to prove, repeatedly and quickly, that you still catch behaviors you already know about, against artifacts that are being reshaped specifically to slip past you.
Evasion Is Attack Logic, and It Starts by Evading the Host
Look at what GTG-20006 was actually doing. They were not using a zero-day or new exploit, but were rebuilding implants until the host security product stopped seeing them, and pairing those implants with a payload that froze the machine's security updates so fresh signatures would never arrive. That is a defense evasion story from start to finish.
This is the line that separates real adversary emulation from checkbox breach and attack simulation. A tool that fires a canned atomic action, in a form the endpoint product already recognizes, tells you a signature matched. It does not tell you whether the control survives an adversary who is deliberately working to disable, deceive, or evade it before the payload ever runs.
From the CEO
"High fidelity attack logic is the only way to get real insight. Assume breach, and understand that defense evasion is not a footnote in the kill chain. It is upfront logic that disables, deceives, or evades host visibility before anything else happens. If your emulation does not carry that logic, you are testing a signature, not a control. And once host visibility has been degraded by design, endpoint logging alone cannot tell you whether you caught it. That is why you have to measure logged, alerted, or blocked on the host and on the network."
Bryson Bort, Founder and CEO, SCYTHE
The practical consequence is that endpoint logging alone is not a validation strategy. When an adversary's opening move is to evade the host, the host is the least reliable witness you have. An agent that has been tampered with, starved of signature updates, or evaded outright does not report that it failed. It reports nothing, and nothing looks identical to clean.
The command and control channel is the check on that. It is the one part of the operation the adversary cannot make disappear, because the whole point of the intrusion is to reach back out. It still has to pick a protocol, emit metadata, and call back on some interval. GTG-20006 understood this, which is why they invested in disposable hosting servers, staged retrieval infrastructure, and DNS manipulation, and why the operation still needed a channel home after every rebuild.
Test the C2, Not Just the Payload
|
Protocol
If your network controls only catch the channel on one transport, you have validated a port, not a behavior.
|
Metadata
Headers, certificates, and user agents are trivially reshaped by the same agent loop that rebuilds the implant.
|
Callback and Jitter
Beaconing analytics tuned for a fixed interval go quiet the moment the adversary randomizes timing.
|
Run the emulation across all three axes, then score a logged, alerted, or blocked verdict on both host and network telemetry for the same technique, at the same moment, and put the two side by side. The delta between them is the most valuable output of the exercise.
Read it this way. Host caught it and network did not means your coverage depends entirely on an agent the adversary is actively engineering against. Network caught it and host did not means the host control is already degraded and you have found it before the adversary did. Neither caught it is an open exposure. Both caught it is the only result that survives an evasive actor, and it is the only one a single-sided test can never confirm.
The Answer Is a ‘Purple Loop’ of Your Own
If the adversary's advantage is an iteration cycle, the defense is a faster iteration cycle. Call it the purple loop.
|
01
|
Emulate
Run real adversary behavior, mapped to MITRE ATT&CK, against a production or production-representative environment.
|
|
02
|
Observe
Pull what your security stack actually recorded, not what the datasheet says it records. Logged, alerted, or blocked, per technique, per control, on the host and on the network. Never one without the other.
|
|
03
|
Score
Turn that into a verdict with no interpretation gap. Silent failure is the enemy, and silent failure is exactly what a payload that freezes security updates is engineered to produce.
|
|
04
|
Fix
Convert each gap into a tracked exposure with an owner, a severity, and a status, so it becomes work rather than a finding in a PDF.
|
|
05
|
Re-run
Prove the fix holds, then keep the emulation in rotation, because the artifact that failed against you today is being rebuilt tonight.
|
That loop is the SCYTHE platform's reason for existing. Adversary emulation on one side, integrated detection validation on the other, and exposure tracking in the middle so the output is remediation rather than reporting.
Why MCP Changes the Tempo
A loop is only as fast as its slowest handoff, and in most programs the slow handoff is human. An operator runs an emulation in one console, pivots to the SIEM to hunt for what fired, exports to a spreadsheet, files tickets by hand, and schedules a retest for next quarter. That is a loop measured in weeks, running against an adversary loop measured in minutes.
SCYTHE + MCP
Host and Network, Scored in One Loop
SCYTHE exposes the platform through the Model Context Protocol, so an AI agent can drive the full cycle as a single connected workflow. Emulations are launched with real C2 and tunable OPSEC. Connected SIEM, EDR, and network telemetry is pulled back and correlated against the emulated behaviors. Coverage is scored per technique as logged, alerted, or blocked, on the host and on the network, with the delta between the two surfaced rather than averaged away. Gaps are opened as tracked exposures with owners. Campaigns are re-run on cadence. Your security stack and your validation platform stop being separate tools a human shuttles between, and start behaving as one system.
The point is not automation for its own sake. The point is parity. GTG-20006 used agents to iterate against detections until the detections failed. The defensive equivalent is agents iterating against your own controls until the controls hold, and then continuing to iterate, because the adversary has not stopped.
"We Are Not a Target" Is Dead
Anthropic makes one more observation that should end that conversation inside most organizations. AI has collapsed the labor and tooling gap that separated well-resourced state operations from individual operators. Their assessment is that the distinguishing feature between these classes of actor is no longer sophistication but intent, and that the capabilities described in the report should be assumed available to any actor motivated to use them. Publicly available offensive agent frameworks reproduce much of the same scaffolding for anyone who downloads them.
The practical takeaway is narrow and actionable. Pick the techniques in that report that map to your environment. Emulate them with the evasion logic attached. Find out what your host controls and your network controls each caught today, not what they caught last October. Then run it again next week.
The adversary is already running continuous validation against your controls. The only question is whether you are the last one to see the results.
Act Before You Need to React
Close Your Loop Faster Than Theirs
See how SCYTHE emulates real adversary behavior with the evasion logic intact, scores logged, alerted, or blocked on the host and on the network, and turns every gap into tracked, owned remediation.
Request a Demo
Source: Anthropic, "Detecting and countering misuse of AI: September 2026," covering threat activity disrupted between December 2025 and August 2026. The report includes downloadable indicators of compromise. Read the full report.
