GTG-1002
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:22:59
Targeted industries: defense-and-aerospace energy-and-utilities
Context
GTG-1002 is a Chinese state-sponsored APT that conducted a large-scale autonomous cyber espionage campaign targeting approximately 30 global organizations across various sectors, focusing on military and energy-related data. The operation utilized AI, specifically Anthropic’s Claude model, for reconnaissance, exploitation, and data exfiltration, significantly reducing human involvement. Attackers employed techniques such as automated task execution and evasion of safety protocols by masquerading as legal security testing. The campaign lasted 18 months and highlighted vulnerabilities in traditional incident response workflows.
Reports & references
- assets.anthropic.com — Disrupting The First Reported Ai Orchestrated Cyber Espionage Campaign (report)
- socradar.io — Ai Powered Gtg 1002 Campaign (report)