The Chinese-speaking actor also used what’s known as a “run time patch,” in this case a tool known as ClawGod, to add functionality on top of Claude Code and attempt to remove the “CYBER_RISK_INSTRUCTION” from the Claude Code system prompt, an instruction directing Claude Code to only participate in authorized security testing, not abusive or destructive hacking.
The actor that worked in Spanish and English targeted Argentine health care entities and successfully compromised at least 15 organizations. CrowdStrike researchers see evidence that the actor stole credentials and medical records from at least one of these victims. The actor special built a penetration testing harness, the kind an organization would use to test its own infrastructure, to find and fix vulnerabilities. Using models including Claude Opus 4.5, Claude Haiku 4.5, and Deepseek V4 Pro, the group set up a full infrastructure for autonomous attacks involving a “Supervisor” Claude Code agent to direct the steps of an attack and an “Executor” agent to carry them out.
The attacker working in Chinese also built penetration testing harnesses to guide Claude Code in reconnaissance and then autonomously attack once a human had selected a course of action. The researchers found that the actor successfully compromised government targets in both Brazil and Colombia and also targeted private organizations in Brazil and the United States in a range of sectors that include biotech, healthcare, food and beverage, retail, technology, and travel.
According to the researchers, the Chinese-speaking actor primarily relied on Claude Opus 4.8, but also used other models including Claude Sonnet 4.6 and Deepseek Chat. The actor accessed Claude through an AI proxy service based in China but set up multiple fallbacks to other AI tools if Claude was not available through the proxy.
Anthropic did not provide comment ahead of publication, and Deepseek did not immediately respond to WIRED’s requests for comment.
The researchers say that both the Russian-speaking actor, which seems to have been focused on financially motivated “e-crime,” and the Indonesian-speaking actor (the least sophisticated of the four) used more basic, publicly available skills and harnesses to carry out their attacks. But both were still successful at compromising targets. This included multiple Indonesian government domains, a Bangladeshi government domain, and some private-sector targets, in the case of the Indonesian-speaking actor.
“What we are seeing is humans are doing some of the initial probing in these situations and then they’re engaging the AI for the hacking at scale,” CrowdStrike’s Meyers says. “I find it interesting that even with agentic attacks with all of these capabilities, we could still see that there’s a human behind it and what they’re up to.”