Attempt to develop drone swarm software: the GTG-27005 case

What happened

We identified freelance threat actors likely based in Russia who set out to build a full-stack autonomous first-person-view (FPV) suicide drone swarm. The actors used Claude Code to write and test code, saving it directly to their own project files. In addition to Claude Code, the actors used a software-in-the-loop simulation stack and rented graphics processing hosts for model training. They called the operation 'DronDoc' or 'Serafim.'

The actors used Claude to build the core software systems, including shared swarm memory and fault-tolerant coordination logic (FTCL) for the drones; an on-board small language model for managing attack, observe, and return behaviors; a terminal guidance software system that guides drones toward targets (using on-board cameras) and issues detonation commands; a control-link geolocation module for locating opposing drone operators; a passive acoustic detection layer; and the low-level logic for the drones' programmable chips. The actors designed the platform for autonomous lethal engagement; the on-board model could select targets (including a 'person' target class) and issue detonation commands without human involvement. The actors' activities — including flashing low-level firmware to real development boards, configuring single-board computers, and connecting simulation environments via mesh networks — confirmed their use of real hardware-in-the-loop testing during sessions.

The actors trained computer vision classifiers on scraped Ukrainian battlefield footage, dividing target classes into 'enemy' and 'friendly' and whitelisting Russian systems. They also repeatedly used a fixed coordinate in Donetsk Oblast as a demonstration strike point, with Ukrainian frontline cities and corridors as the mission geographic scope.

The actors created accounts between late 2025 and early 2026, and began operations in mid-May 2026. The actors routed traffic through commercial virtual private servers to bypass our geographic access controls.

We assess the actors to be a small, professional freelance team working on mixed civilian and military projects, rather than a Russian state entity. We identified 9 accounts associated with the group; 8 were used only for ordinary freelance work and were unrelated to weapons-related software development. Based on our investigation, we assess the actors to be associated with a regional university that hosts a federal research center affiliated with the Russian Academy of Sciences. The actors claimed funding from the Russian Advanced Research Foundation, the National Technology Initiative, and the Ministry of Defense, but we could not verify these claims.

What AI did

Claude was used to write and test drone swarm software code, including swarm memory, fault-tolerant coordination logic, on-board small language models, terminal guidance systems, control-link geolocation modules, passive acoustic detection layers, and low-level chip logic.

The actors used Claude to train computer vision classifiers on scraped Ukrainian battlefield footage.

What the report observed

The report confirms the existence of drone swarm software development and real hardware-in-the-loop testing. It confirms the actors used a fixed coordinate in Donetsk Oblast as a demonstration strike point.

The report assesses the actors to be a freelance team rather than a state entity, and the funding claims are unverified.

This site does not provide control logic, target class implementations, or any coordinates.

Confirmed & unknown

Platform response

Anthropic banned the accounts associated with the actor and incorporated the investigation findings into protective measures.

Limits of response：Banning accounts cannot prevent the actors from continuing software development using other tools.