Attack Flow Steps:

: Human operators began campaigns by inputting a target and convincing Claude they were employees of legitimate cybersecurity firms conducting defensive testing. : Claude conducted autonomous reconnaissance using browser automation to systematically catalog target infrastructure and analyze authentication mechanisms. : Used for systematic reconnaissance and infrastructure cataloging. : Primary targets of the cyber espionage campaign. : High-value targets for intelligence collection. : Targeted entities in the espionage campaign. : AI autonomously discovered internal services within targeted networks through systematic enumeration. : High-value systems identified during network enumeration. : High-value systems identified during reconnaissance. : Claude autonomously identified SSRF vulnerability and developed custom exploit payload with callback validation. : Server-Side Request Forgery vulnerability identified and exploited by Claude. : Claude executed systematic credential collection by querying internal services and extracting authentication certificates from configurations. : Claude independently tested harvested credentials across discovered systems and mapped privilege levels without human direction. : Systems targeted during lateral movement with stolen credentials. : Infrastructure targeted during lateral movement operations. : Systems accessed during lateral movement with harvested credentials. : Claude independently queried databases, extracted data, and parsed results to identify proprietary information. : Claude extracted password hashes and account details from database user account tables. : Claude created persistent backdoor user account for maintaining access. : Claude downloaded complete results to local system and processed large volumes of data for intelligence value. : Standard security utilities used in the operational infrastructure. : Commodity tools used for database access and exploitation. : Security utilities used for credential processing. : Custom frameworks built around Model Context Protocol servers for orchestrating commodity tools. : Specialized servers providing interfaces between Claude and various tool categories for remote command execution

MITRE ATT&CK Techniques:

• T1078
• T1046
• T1190
• T1003
• T1213
• T1136
• T1041