Three Hours to Take a Company Apart

To understand the technical words and acronyms used in this series, please refer to this: A Primer on Terminology

For about twenty years, the people who investigate computer break-ins worked out who had attacked them by looking at how well the attack was built. A clumsy attack meant an amateur working alone, while a polished one meant a government, because only a government could afford the staff required to build anything good. This section follows the collapse of that shortcut and what it means for a country that runs the largest identity database on earth.

Anthropic puts the trend plainly: how sophisticated an attack looks no longer tells you much about who carried it out. The four largest break-in cases in its report were run by people with almost nothing in common, yet all four worked in nearly the same way.

The four cases make the point clearly. One involved Russia’s foreign intelligence service. Another involved two undergraduates in a Chinese provincial city. A third was a loose crew of criminals scattered across Europe. The fourth was a single man in France, working alone against political parties and the software companies that serve them. If you set their methods side by side, it is hard to tell which actor is which. What still separates them is motive: secrets in the first case, money in the third, and a political enemy’s private records in the fourth.

The four operations

GTG-20006, Russian state espionage

Anthropic attributed this operation to activity consistent with public reporting on Midnight Blizzard, a name used for a Russian foreign-intelligence hacking group; one operator used the handle JackPoterz. Investigators found more than twenty organisations in planning, reconnaissance or active operations, including government ministries, defence and intelligence bodies, embassies, think tanks and defence-industrial firms. The activity was concentrated in Ukraine and Europe but also reached the Middle East and maritime agencies in Asia. Email and remote-access systems across more than two dozen Ukrainian government organisations were scanned.

The toolkit spanned Windows implants, meaning hostile software left running quietly inside a machine, an Android surveillance program of the kind that lets an attacker operate a phone from a distance, an iOS exploit chain, a tool for stealing the passwords saved in a victim's browser, a phishing platform mimicking government sites, and an administrative console for managing compromised accounts.

Three things in this case matter more than the inventory.

First, the actor used AI agents to monitor whether their malware had been flagged by security products, then to rebuild it autonomously until it went undetected.

Second, to reach protected targets indirectly, they compromised at least three hospitality vendors that ran hotel guest WiFi. They changed the records that tell the internet where a web address leads, a technique called DNS hijacking. As a result, some guests connecting to hotel networks had their traffic, device identifiers and IP addresses routed to attacker servers. Fake error messages, known as ClickFix lures, then delivered Windows, Android and iOS malware. Microsoft published its own account of this technique in July 2026, giving the case one of its few points of outside corroboration.

Third, they took over victims’ WhatsApp accounts using headless browsers to register as companion devices, with read receipts suppressed so nobody noticed while conversations were bulk-exported. At least two former senior Ukrainian officials were hit this way.

Against a North African government technology authority, the same actor stole VPN credentials, took the central account server, and exfiltrated the full credential database: more than 300,000 national identity records and commercial registry data on over half a million companies.

GTG-10007, the exploit foundry

The operators were Chinese speakers assessed as residing in Changsha in Hunan province, and two of them were identified as undergraduates at a local university studying in a school of computer and communication engineering. One had interned at the Chinese security firm Sangfor and was interviewing for an offensive cyber role at QiAnXin.

What they ran amounted to a standing research institute without human researchers. Firmware images, the software stored inside devices, were decrypted with a purpose-built routine, unpacked and loaded into decompilers, which turn machine code back into something closer to human-readable code. Agents then followed links across thousands of decompiled calls, formed guesses about possible vulnerabilities against a knowledge base built over time, wrote exploit code, tested it against lab copies of the target product, and repeated the process until it worked. One workflow against network appliances produced more than a dozen candidate zero-days in a single month. A zero-day is a flaw the manufacturer does not yet know about and therefore cannot repair.

Parallel workstreams ran reconnaissance against foreign governments, developed malware, and operated a fleet of thirteen standing collection agents that crawled US military and government sites on a schedule, with an adjacent pipeline scoring and summarising the haul in the style of intelligence reporting. Around fifty organisations were targeted across education, retail, energy, technology, healthcare, finance, manufacturing and government. Hundreds of megabytes of student data came out of an education technology company. A Southeast Asian government agency yielded citizen records including names, phone numbers and home addresses.

Notably, the group targeted globally through automated workflows but concentrated its hands-on intrusion work exclusively on victims inside China.

GTG-50014, the credential economy

A cluster of operators was assessed as affiliates of the ShinyHunters collective. One ran a pipeline across ten cloud workers that downloaded 1.8 million separate Android app installation files from various app stores, took each one apart, and searched inside for passwords and access keys that the developers had left buried in the code by mistake; verified findings were routed in real time into a Telegram group organised into more than a hundred source types. A parallel harvester running against code-hosting organisations supplied a second stream made up of stolen personal access tokens.

What those credentials bought: more than a terabyte from a technology provider, including hundreds of thousands of national identifiers and millions of payment card records, staged on a public site to force a ransom; systems at an airline holding tens of millions of passenger records; and claimed remote control over the charging current of electric-vehicle chargers installed in customers’ homes at an energy company.

One affiliate within the cluster specialised in supply-chain theft: breaking into a service provider in order to reach that provider’s customers. After breaching a software-as-a-service provider, they extracted data belonging to roughly 200 downstream customers. They then dumped a session store containing over 2,100 Azure AD token sets across more than forty corporate tenants in about 34 hours. Anthropic records that AI agents performed nearly all of the work involved in that operation.

Operational tempo is where this case becomes difficult to absorb, because one enterprise software breach ran hours from first access to bulk theft. Another escalated from a single stolen developer token to full administrative control of a cloud environment in roughly three hours.

The same actors also collected legitimate bug-bounty payouts of $2,000 and $5,000 from two companies they had infiltrated and were extorting, treating disclosure programmes as an additional revenue line against the same victims, and scraping bounty submissions as reconnaissance.

GTG-50029, one person

A single French-speaking actor targeted European political parties, media outlets, think tanks and their software vendors. They built a Rust scanner to find and validate exposed API keys in public containers, then rotated stolen keys through a local proxy so their traffic blended with the legitimate owner’s.

Their signature technique exploited a previously unknown timing flaw in WordPress. Engineers call this kind of flaw a race condition: an attacker slips into the gap between two steps a system performs in sequence. Here, that gap allowed an administrator account to be created without any valid password, and the actor developed and debugged the exploit in the same session with a purpose-built lab harness. The exploit worked against at least four victim websites. Against a political campaign management platform, they exfiltrated roughly 140,000 records, including users’ political opinions.

Elsewhere, they planted a webshell hidden among the website’s font files; the webshell turned the victim’s own website into a back door for remote commands. They wrote it on the spot as the upload flaw was found, installed a WordPress must-use plugin that harvested submitted credentials and encrypted them with per-site keys, and poisoned the victim’s backups so that restoring a supposedly clean environment would reinfect it. At a media outlet, they deployed a browser-exploitation framework through an injected script, fingerprinting thousands of visiting readers while specifically hunting the editorial staff’s sessions.

Then they built fafsearch, a search engine for exposing private individuals, with ingestion pipelines, cross-referencing of breach dumps against their own stolen data, normalisation of national identity and phone numbers, ranking logic, tests and containerised deployment. They loaded it with tens of millions of rows, including national health identifiers and material from justice-system breaches, and published it as anonymously hosted dark-web services where people affiliated with a targeted political movement could be looked up by name.

Across 42 tracked target entities, they obtained internal access to at least fourteen, and the entire campaign was the work of one individual.

What has changed?

Nothing in the technique catalogue is new to anybody who has worked in network defence, since the whole inventory consists of stolen credentials, unpatched edge devices, exposed services, injection and phishing.

What changed was the price of the labour that used to separate governments from everyone else. Reconnaissance, exploitation, tool development and data processing can now be delegated to models running in harnesses, at machine speed and in parallel.

This reverses who bears the cost, pushing more of it onto defenders. Shipping a new detection signature used to slow an attacker and impose real expense. A capable adversary can now close that loop at machine speed, while the defender writing the signature works at human speed. Freely downloadable attack frameworks then package the same machinery for anyone who wants it, spreading an operating model first documented in a single state campaign in November 2025 across every class of actor since.

Autonomy sits on a spectrum in these cases, and the report is careful about that distinction. At one end is familiar conversational help: a model assists a person who remains in control. In the middle are models that execute parts of an operation while a human still makes each targeting decision. At the far end are multi-agent frameworks that run reconnaissance, exploitation and theft against multiple victims in parallel for hours or days. Some collection agents also ran to a timetable with no human involved at any point.

Two caveats matter, and honest coverage should keep both. Humans still made the decisions they cared about: choosing targets, deciding how to make money, and reviewing results. Autonomy and harm are also different things and should not be treated as the same. Some of the most serious compromises came from operations where a human directed every step. What autonomy changes is the cost of each attack. It lowers the attacker’s labour cost while leaving the possible payoff roughly the same, which makes targets worth hitting that previously would not have been worth the effort.

Where does India sit in this?

Three exposures follow from this material, and none of them is hypothetical.

The identity layer

India operates the largest identity-linked digital infrastructure anywhere on earth, and the report happens to contain a working preview of what the compromise of such a system produces, staged in North Africa and Southeast Asia instead of here.

The supply chain

India’s software-as-a-service export sector matters in this threat model for two reasons. First, Indian providers can be breached directly. Second, they can be used as routes into their customers. The report documents affiliates who spent their time doing exactly that.

The app ecosystem

Every Indian developer who has ever shipped a credential inside an APK is in a dataset built exactly like the one described above, or in its successor.

The blunt conclusion is that security through obscurity is finished. Diverse target environments are now easy to understand, and obscure configurations can be made legible and exploitable. For any defensive posture that has quietly depended on being complicated, that is a strategic problem, not a technical one.