National security and intelligence stakeholders

Incidents Harmed By

Incident 111841 Report
Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

2021-01-01

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to generate fake resumes, alter profile photos, and assist in real-time responses during video interviews.

Incident 106933 Report
Purported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers

2025-01-31

Researchers at Citizen Lab and Censys reportedly identified spyware infections involving Graphite, a tool attributed to Israeli firm Paragon Solutions. The spyware was allegedly deployed against civil society actors, including journalists and aid workers, through a zero-click WhatsApp exploit. WhatsApp notified over 90 targeted individuals. Evidence reportedly suggests deployments in multiple democratic countries.

Incident 126333 Report
Chinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage

2025-11-13

Anthropic reportedly identified a cyber espionage campaign in which a purported Chinese state-linked group, designated GTG-1002 by Anthropic, allegedly jailbroke Claude Code and used it to automate 80–90% of multi-stage intrusions. The AI reportedly independently performed reconnaissance, vulnerability discovery, exploitation, credential harvesting, and data extraction across roughly 30 targets before the activity was detected and blocked.

Incident 96827 Report
'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation

2022-02-24

A purported Moscow-based disinformation network, Pravda, allegedly infiltrated AI models by flooding the internet with pro-Kremlin falsehoods. A NewsGuard audit found that 10 major AI chatbots repeated these narratives 33% of the time, citing Pravda sources as legitimate. The tactic, called "LLM grooming," manipulates AI training data to embed Russian propaganda. Pravda is part of Portal Kombat, a larger Russian disinformation network identified by VIGINUM in February 2024, but in operation since February 2022.

National security and intelligence stakeholders

Incidents Harmed By

Incident 111841 ReportOngoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

Incident 106933 ReportPurported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers

Incident 126333 ReportChinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage

Incident 96827 Report'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation

Related Entities Related EntitiesOther entities that are related to the same incident. For example, if the developer of an incident is this entity but the deployer is another entity, they are marked as related entities.

Related Entities

Misinformation spreaders

Incidents involved as Deployer

Disinformation spreaders

Incidents involved as Deployer

Unknown malicious actors

Incidents involved as Deployer

Unknown AI image generator developer

Incidents involved as Developer

Unknown deepfake technology

Incidents involved as Developer

Incidents implicated systems

Twitter Users

Incidents Harmed By

Family of People Near Pentagon

Incidents Harmed By

Investors

Incidents Harmed By

General public

Incidents Harmed By

General public of the United States

Incidents Harmed By

Truth

Incidents Harmed By

Epistemic integrity

Incidents Harmed By

Unknown AI image generator

Incidents implicated systems

X (Twitter)

Incidents implicated systems

Social media platforms

Incidents implicated systems

VKontakte

Incidents involved as Deployer

Russian media outlets

Incidents involved as Deployer

Pro-Russian Telegram channels

Incidents involved as Deployer

Pro-Kremlin actors

Incidents involved as Deployer

Unknown deepfake technology developers

Incidents involved as Developer

Incidents implicated systems

Unknown voice cloning technology developers

Incidents involved as Developer

Incidents implicated systems

Julien Fanciulli

Incidents Harmed By

France 24

Incidents Harmed By

General public of France

Incidents Harmed By

Ukraine-France relations

Incidents Harmed By

Unknown voice cloning technology

Incidents involved as Developer

Incidents implicated systems

Russian government

Incidents involved as both Developer and Deployer

Incidents involved as Deployer

FSB

Incidents involved as Deployer

Federal Security Service

Incidents involved as Deployer

Ukraine

Incidents Harmed By

Democracy

Incidents Harmed By

American public

Incidents Harmed By

General public of the European Union

Incidents Harmed By

Electoral integrity

Incident 111841 Report
Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

Incident 106933 Report
Purported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers

Incident 126333 Report
Chinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage

Incident 96827 Report
'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation

Related Entities