GTG-20006 is Midnight Blizzard
Assessment
Anthropic's wording is "our attribution is consistent with public reporting linking the actor to Midnight Blizzard," and its own figure is titled "GTG-20006 | Midnight Blizzard." Microsoft, reporting the hotel-Wi-Fi campaign from its own telemetry on 31 July, attributes it to Storm-2945, "a sub-cluster of Midnight Blizzard." Four domains appear in both vendors' indicator lists, which ties the clusters together more firmly than either report's language does. No government has attributed this specific activity. The umbrella group is APT29, assessed as the Russian SVR; the link from this operator to that agency runs through two vendors' clustering.
Where this claim appeared
The Hacker News · 2026-09-10
https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.htmlWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was CaughtThink this assessment is wrong? Report an error.