The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The Anthropic AI-orchestrated Campaign was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the Anthropic AI-orchestrated Campaign, human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.[1][2]
26
TechniquesTop 23%
10
Tactics68th pct
0
Tools & malwareNone recorded
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to automatically gather sensitive data stored within the local system to include credentials, system configurations and sensitive operational data.3
During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.4
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to enumerate internal network services and endpoints across targeted environments using browser automation via MCP, including databases, container registries, admin interfaces, and workflow orchestration platforms.5
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to stage extracted data and operational documentation in structured markdown files on local systems prior to exfiltration.7
During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks.8
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques26Top 23%
77th percentile · 77% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics1068th pct
68th percentile · 68% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware0Bottom 11%
11th percentile · 89% of 56 ATT&CK campaigns have more tools and malware.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique11.5med34th pct
34th percentile · 66% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique0medBottom 23%
23rd percentile · 77% of 56 ATT&CK campaigns have more atomic tests per technique.
Data comps / technique4med43% tie · 7 values
43% of the population shares a single value across only 7 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique1med38th pct
38th percentile · 62% of 56 ATT&CK campaigns have more mitigations per technique.
6 of 8 axes carry an honest rank on this page. Coverage medians are taken across this campaign’s 26 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
647 distinct rules cover the 26 techniques recorded for this campaign. 404 Sigma · 243 Splunk.
20 covered by at least one rule6 with no coverage647 distinct rules in total
Showing 1-50 of 600+ rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)
Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
2022-08-11
2022-08-18
6f583da0-3a90-4566-a4ed-83c09fe18bbf
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-01
—
248649b7-d64f-46f0-9fb2-a52774166fb5
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.