CrowdStrike finds four groups using Claude Code in cyberattacks

CrowdStrike detailed in an October 21 report four previously unreported threat actors using AI agents to conduct cyberattacks. Between May and August 2026, the groups used agents to make operational decisions and execute commands across multiple attack stages.

A Spanish and English speaking operator used two Claude Code agents against healthcare organizations in Argentina, compromising at least 15 entities and stealing credentials and medical records from at least one victim. A Chinese speaking operator targeted more than 20 organizations, compromised government entities in two countries and used Claude through a China based proxy service. Its frameworks could assign work to one agent or several specialist agents in parallel.

An Indonesian speaking actor used 819 publicly available skills with Claude Code and compromised several government and private sector domains, although human intervention was sometimes required. A Russian speaking group used a single command to give Claude Code a seven step workflow with broad control over exploitation and data theft. That group stole corporate client data from a U.S. customer relationship management vendor and compromised software and data center organizations in Russia, Kyrgyzstan and the U.S.