APT29

APT29 is a Russian state-sponsored hacking group, also known as Cozy Bear or Midnight Blizzard, that is linked to Russia's foreign intelligence service (SVR). The group is known for long-running espionage campaigns against governments, think tanks, and technology companies, including the 2020 compromise of SolarWinds software updates that reached thousands of organizations. For enterprise AI governance teams, APT29 matters because its tactics, such as abusing trusted software supply chains and stealing cloud and identity credentials, are the same risks that affect AI model pipelines, third-party AI tools, and vendor integrations.

1 item

ResearchGlobal2026-10-16

APT29 Used Claude Agents to Auto-Rebuild Malware 5 Times in 25 Days

Research from ReversingLabs shows Russian state-linked threat group APT29 used Claude-powered agentic workflows to automatically rebuild malware each time security tools detected it. This produced five distinct variants over 25 days. Despite the faster evasion cycle, behavior-based detection caught every iteration because the malware's core actions remained unchanged. The finding has direct implications for how enterprises assess detection controls and vendor AI misuse risk.

APT29 Anthropic Claude agentic AI adversarial AI malware evasion threat detection cybersecurity