Public information used for identity profiling: the GTG-30004 case

What happened

We identified an Iran-linked threat actor who used Claude to build an automated open-source intelligence identity profiling tool targeting Israeli government and non-government individuals and Jewish diaspora organizations. Separately, the actor used Claude to make its malware harder to identify as malware.

What AI did

In one workflow, the threat actor built and used Claude to orchestrate an open-source intelligence and reconnaissance tool to profile hundreds of individuals in Israeli and Jewish diaspora communities. The threat actor ran an automated identity profiling tool that enriched pre-existing target lists. The actor attempted to generate open-source intelligence products about Israeli and American individuals. The threat actor used Claude to accelerate its ability to collect and analyze open-source data.

In a parallel workflow across multiple Persian-language sessions, the threat actor modified the open-source LSASS credential dumper NanoDump and used Python to build a custom C++ obfuscation/build pipeline that renames identifiers and injects dummy functions, likely aimed at obfuscating malware samples and hindering analysis.

What the report observed

The report confirms the existence of the automated open-source intelligence profiling tool, as well as the modification of NanoDump and the construction of the obfuscation pipeline.

This site does not provide any personal profile fields or target lists.

Confirmed & unknown

Platform response

Anthropic banned the relevant accounts.

Limits of response：Banning accounts cannot recover already collected open-source intelligence data, nor prevent the actor from continuing activities using other tools.