# When Your EDR Catches Their Malware, They Just Ask Claude to Rewrite It
Detection used to mean something. An endpoint agent flags a piece of malware, the sample gets pulled, signatures get written, and the defender wins that round. Russian state-sponsored operators have been quietly dismantling that assumption — by using Claude as an on-demand code rewriter every time a sample gets burned.
Anthropic's threat intelligence team documented the behavior in a disclosure that's getting less attention than it deserves. The technique isn't novel in concept — malware authors have been writing polymorphic and metamorphic code for decades — but the operationalization is new. Instead of building complex mutation engines into the malware itself, these actors are outsourcing the rewrite job to a large language model. Get detected, query Claude with the flagged payload, have it return a functionally equivalent version with different structure, new variable names, shuffled logic blocks. Rinse.
## The Feedback Loop Nobody Prepared For
The threat model most security teams built assumes that detection has some durable value. Write a YARA rule, add a signature, block the hash. The traditional cat-and-mouse was slow — attackers would eventually retool, but it took time and developer resources.
AI collapses that timeline. A skilled operator using Claude as a mutation assistant can iterate on a detected sample in minutes, not days. The detection infrastructure that took a threat intel team hours to build gets arbitraged away in a single API session.
What's especially notable here is the workflow: the operators aren't using AI to develop novel attack capabilities from scratch. They're using it as a force multiplier for an existing operation that's already mature. The initial intrusion tradecraft, the command-and-control infrastructure, the targeting — that stays constant. The AI piece handles the one-way ratchet that defenders thought they held: signature-based detection.
## What They're Actually Doing With the Model
The specifics matter for defenders. Based on what Anthropic disclosed, the actors were using Claude for code comprehension and transformation — not for generating zero-days or designing novel exploits. This is a meaningful distinction.
The use case looks like: take a working implant that just got flagged, feed it to Claude with instructions to rewrite the logic while preserving behavior, and deploy the new variant. The model is good at this because code transformation is a well-formed task: understand what the code does, reproduce that functionality with different structure.
Security teams who've been tracking AI-assisted threats have focused heavily on the generation angle — "can AI write new malware?" The detection-evasion angle is operationally more dangerous right now, because it directly attacks the value of existing defenses rather than theorizing about future ones.
It's also worth noting the model safety dimension: Anthropic has usage policies that prohibit malicious use, and the company actively monitors and acts on policy violations. But state-sponsored operators don't announce themselves as APT actors when they spin up accounts. They probe, they test, they find the right framing. Jailbreak-through-context is an ongoing arms race.
## Who's Running This
The attribution in Anthropic's report points to Russian state-sponsored actors — a characterization that aligns with existing APT tracking. Russia's advanced persistent threat ecosystem, including groups tracked under names like Cozy Bear (APT29), Fancy Bear (APT28), and Sandworm, has always been technically adaptive. They were early adopters of living-off-the-land techniques, early adopters of supply chain attacks, and apparently early adopters of AI-assisted malware iteration.
The targeting profile for these operators — government networks, defense contractors, critical infrastructure — means the organizations least equipped to deal with rapidly mutating malware variants are exactly the ones facing this technique most urgently.
## What Defenders Actually Need to Hear
Signature-based detection was always a partial answer. This makes it more partial. The practical response isn't to abandon signatures — they're still catching real attacks — but to ensure they're not the last line.
Behavioral detection has been the right investment for years, and this reinforces why. A rewritten implant that does the same things the original did — makes the same network calls, accesses the same file paths, communicates with the same C2 infrastructure — will still get caught by a behavioral engine that doesn't care about code structure. Focus there.
Threat hunting becomes more valuable, not less. If signature detection degrades as a reliable signal, the gap has to be filled by analysts looking for behavioral anomalies, unusual process trees, and lateral movement patterns. The static indicator is less durable. The behavioral footprint is much harder to LLM your way out of.
---
## HackWire Analysis
This story is being covered as "AI misuse" — and while that framing isn't wrong, it undersells the operational implication. The real story is that AI has changed the economics of detection evasion.
Before, every rewrite cost an attacker developer time. Developer time is a scarce resource even for well-resourced state actors. The scarcity created a natural brake: get detected enough times, burn enough samples, and you'd start to degrade the operation. The attacker had to weigh continued operations against the cost of retooling.
That brake is partially gone now. LLM-assisted rewriting is cheap. The cognitive overhead of restructuring code to evade a new signature is largely offloaded to the model. What took a developer hours now takes an operator minutes. This shifts the economics in favor of persistence — attackers can afford to keep running an operation that keeps getting partially detected.
The broader pattern here is important: this is at least the third documented case of nation-state actors integrating LLM assistance into active operations (following Microsoft's disclosures in early 2024 about multiple state groups probing GPT-4 for operational uses). The progression is from "can AI help us attack?" to "how specifically does AI fit into our existing TTPs?" Russian operators appear to have answered that question in a concrete way for detection evasion.
For vendors selling detection products: the value proposition of a purely signature-based system just got harder to defend. For CISOs evaluating detection stacks: ask your vendors specifically how their detection holds up against a variant that preserves behavior but changes code structure. That question will tell you a lot.
The defenders who will weather this well are the ones who moved toward behavioral baselines, process telemetry, and network traffic analysis years ago. The ones who are 80% dependent on hash-based blocking are about to have a very bad time.
— HackWire Editorial
---
## Related Coverage