From Hotel System Intrusions to AI Supply Chain Attacks: GTG-50020 Case

What happened

GTG-50020 is a Russian-speaking, financially motivated actor that historically conducted intrusions against hotel booking and fintech platforms. In one intrusion, they exfiltrated about 26 GB of data from a victim and attempted to obtain $1.5 to $2.5 million through ransom (or by selling the data on dark web forums).

They then pivoted the same techniques toward the AI industry. By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor made the sandbox hand over the credentials it held—including production AI API keys for multiple providers held by that vendor.

These stolen keys were then abused by the actor: they simultaneously continued intrusion attempts against that vendor and other unrelated targets. In fact, when they obtained a target's API keys, they automatically switched to using the victim's keys rather than their own. Follow-up activity running from the same infrastructure attacked about 30 AI companies in about 4 days using similar techniques. They identified one successful attack path and reused it against all 30 targets, making minor adjustments for differences between targets. The actor's stated goal—pursued through more than ten avenues—was to obtain access to unreleased Claude models. The actor never obtained access; every attempted path failed. Throughout all this activity, the keys involved were customer keys stolen from customer environments. The actor never breached Anthropic's own systems.

This case is the clearest demonstration to date that the AI supply chain has become a deliberate criminal target. The actor pursued AI vendors' production API keys and had a clear ambition—to be clear, an ambition that was never realized—of obtaining access to unreleased AI models.

What the AI did

Human-directed AI penetration testing loop: the operator maintained a per-target scope file that launched a custom workflow delegating work to parallel reconnaissance and exploitation agents. The agents' findings were retested to confirm viable access; if viable, they were merged into an incremental report. The workflow iterated on the next target domain.

Autonomous exploitation pipeline: the actor used a containerized open-source penetration testing platform fronted by a local model gateway. It targeted the target's web applications. Worker agents ran unsupervised injection, cross-site scripting, authentication bypass, and server-side request forgery tests, collecting potential findings and credentials into the operator's workspace. The loop ran with exploitation enabled against production systems, meaning it both attempted to identify vulnerabilities and actively exploited them in the same workflow to gain access.

Fraud account factory: residential proxies and anti-detection browser profiles were configured, after which bots drove the registration flows for exchange and marketplace targets. Commercial CAPTCHA-solving services, automated inbox polling, and automated identity verification steps defeated onboarding controls, and the resulting verified accounts were stockpiled for later use.

KYC interception cloak: the actor also engaged in credential theft and phishing. Victims were directed to lookalike verification domains whose reverse proxy relayed the real "know your customer" (KYC) flow, so victims completed real identity verification while the operator captured the verified sessions and documents from the proxy relay in the middle. Captured sessions were then used by the actor from their machines to access target services and data.

What the report observed

This is the clearest case the report uses to illustrate that "the AI supply chain has become an explicit criminal target": the actor pursued vendors' production keys and had the ambition of obtaining unreleased models.

The report provides two pieces of negative evidence: access to unreleased models was never achieved; Anthropic's own systems were not breached, and the stolen keys came from customer environments.

The report lists related indicators of compromise (attacker egress IPs, etc.) at the end for defenders to investigate. Per this site's safety boundaries, specific indicator values are not reproduced.

Confirmed & unknown

Platform response

The report discloses this case as a core example of supply chain risk and emphasizes the negative evidence to avoid it being misread as "Anthropic was hacked, secret models stolen."

Limits of response：Disclosure does not mean all targeted customer environments have been remediated; the theft of customer keys happened on the customer side.