Data Theft Targeting European Political Organizations: GTG-50029 Case

What happened

AI has helped close the capability gap, turning low-level "hacktivists" into advanced persistent threats. As our case studies repeatedly show, AI capability raises the baseline while lowering the resource requirements for offensive cyber operators. In this section, we provide details of a hacktivist campaign we investigated and disrupted, where small but motivated operations were able to achieve significant goals due to AI being integrated into their operations.

In spring 2026, a French-speaking actor was observed using Claude to target European political parties, media, think tanks, and the software-as-a-service (SaaS) providers used by these organizations.

The actor built their own custom Rust-based scanner designed to scan and validate API keys exposed in public containers. Once a key was validated, the actor's tools were designed to rotate key usage through a local proxy layer. This allowed the actor to mix their traffic with the traffic of the legitimate owner of the stolen API key. As we saw in the case studies above, obtaining exposed APIs removes barriers to entry for malicious actors.

GTG-50029 provides another example of an actor embracing AI use throughout the kill chain. The actor used AI's agent coding capabilities within a framework that helped them manage sub-agents; the sub-agents themselves were responsible for pre- and post-authentication reconnaissance, code review, and cross-checking findings from different AI models.

What the AI did

Novel exploits and custom tools: the campaign's signature technique for initially accessing target systems was exploiting a previously undocumented WordPress reinstall race condition that created a rogue administrator account without valid credentials. The actor used Claude to develop and debug the exploit in the same session, including creating an experimental test framework. It successfully targeted at least four victim websites.

In one case, the actor intruded into a political campaign management platform through an exposed search endpoint. The actor instructed their agent to iterate through the endpoint, ultimately exfiltrating about 140,000 records, including users' political opinions.

Against another target, the actor planted a webshell hidden inside a font resource (a webshell is a small script placed on a web server that allows an attacker to remotely send commands for the server to run, effectively a backdoor accessible through the website itself). The actor built the webshell on the fly when they identified a vulnerability allowing uploads. They also used a WordPress "must-use" plugin—a plugin that runs on every page load and cannot be disabled from the admin dashboard—that collected submitted credentials, encrypted them with a per-site public key, and staged them for retrieval. Additionally, GTG-50029 tampered with the victim's backups, likely to maintain persistence. If the victim restored a previous environment from backup, they would be reinfected.

Finally, the actor intruded into a media organization by deploying a browser exploitation command and control (C2) framework that hooked the organization's readers through injected scripts. This allowed the actor to fingerprint thousands of visiting browsers. We observed the actor specifically hunting for editorial staff sessions and credentials through this framework.

The actor's signature tool was "fafsearch," a custom doxxing platform. The platform provided a compiled search engine, complete with an ingestion pipeline, the ability to cross-reference personal data breach dumps with exfiltrated data, normalization of national ID numbers and phone numbers, ranking logic, tests, and containerized deployment. The actor loaded tens of millions of rows of data into the platform, including information such as national health identifiers and justice system breach data, and fused it with material obtained from their own intrusions. They published the results as a set of anonymously hosted dark web services where individuals associated with targeted political campaigns could be queried by name.

This is one of the clearest cases we have seen of AI-assisted software engineering directly applied to large-scale privacy attacks—and the entire platform was created by a single person.

What the report observed

Of the 42 tracked target entities, the actor gained internal access to at least 14. The actor accessed and exfiltrated an estimated 12 to 26 GB of database dumps, including information on political party donors and members, a 15,000-message mailbox, student application records (including minors' data), and payment provider data. The actor also set up real-time credential interception. Using the exfiltrated data, the actor staged encrypted archives for each victim on a Tor leak site operated by the actor.

The report lists related indicators of compromise (IPs, domains, etc.) at the end for defenders to investigate. Per this site's safety boundaries, specific indicator values are not reproduced.

Confirmed & unknown

Platform response

Anthropic says it investigated and disrupted the campaign. This site does not reproduce the IPs, domains, or personally identifiable fields from the report.

Limits of response：Disrupting platform accounts does not mean all stolen data has been recovered, nor that all victim systems have been cleaned up.