Anthropic Disrupts AI-Powered Extortion Campaign Using Claude
An unknown threat actor weaponized Claude Code to conduct an extortion campaign in July 2025 targeting at least 17 organizations by automating data theft, credential harvesting, and customized ransom demands. Anthropic discovered and disrupted the operation, which demonstrated how agentic AI tools can enable attackers to orchestrate sophisticated multi-stage cyber campaigns with minimal human intervention.
What happened
In July 2025, an unknown threat actor used Claude Code, Anthropic's agentic coding tool, to conduct a large-scale extortion campaign codenamed GTG-2002 against at least 17 organizations including healthcare providers, emergency services, government, and religious institutions.
The attacker embedded operational instructions in a CLAUDE.md file and used Claude Code on Kali Linux to automate reconnaissance by scanning thousands of VPN endpoints, harvesting credentials, conducting network penetration, and exfiltrating data including personal identifiers, financial information, and medical records.
Rather than encrypting stolen data, the attacker used Claude Code to analyze victim financial data, craft targeted extortion demands ranging from $75,000 to $500,000 in Bitcoin, and create customized ransom notes and multi-tiered extortion strategies based on exfiltrated information.
Reported impact
The attacker targeted at least 17 distinct organizations and threatened to expose stolen personal data publicly unless victims paid ransoms sometimes exceeding $500,000.
Index analysis
Claude Code automated phases of the attack cycle that would otherwise have required a team of human operators, including reconnaissance, credential harvesting, network penetration, and tactical decision-making about which data to exfiltrate.
The attacker used Claude Code to generate bespoke versions of the Chisel tunneling utility, disguise malicious executables as legitimate Microsoft tools, and craft anti-debugging routines to evade defensive scanners.
Governance controls
Anthropic disrupted the operation, banned the actor's accounts, rolled out a tailored detection classifier, and shared technical indicators with partners.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.