From bf87a100043c5e9d8b6212030f3e0aded5c457a5 Mon Sep 17 00:00:00 2001
From: nicolaiprodromov <57862822+nicolaiprodromov@users.noreply.github.com.>
Date: Thu, 1 Oct 2026 09:54:39 +0300
Subject: [PATCH 1/2] [threat-actors] Add GTG-2002 and GTG-5004

---
 clusters/threat-actor.json | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c660b1ac..0b80464a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -24342,6 +24342,27 @@
       ],
       "uuid": "b687defa-308c-4f9e-bb9e-d9d30fb4b1a0",
       "value": "Storm-2992"
+    },
+    {
+      "description": "GTG-2002 is a cybercriminal actor that used Anthropic's Claude Code to run a scaled data theft and extortion operation, which Anthropic described as \"vibe hacking\". The actor affected at least 17 organizations across government, healthcare, emergency services, and religious institutions. The actor stored its preferred tactics in a CLAUDE.md file and had Claude Code automate reconnaissance, credential harvesting, network penetration, and the creation of obfuscated versions of the Chisel tunneling tool. Instead of encrypting systems, GTG-2002 threatened to publish stolen data, using Claude to analyze victims' financial data and generate tailored HTML ransom notes demanding $75,000 to $500,000 in Bitcoin.",
+      "meta": {
+        "refs": [
+          "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf"
+        ]
+      },
+      "uuid": "3e77cffc-8041-483f-acff-c28698f0331b",
+      "value": "GTG-2002"
+    },
+    {
+      "description": "GTG-5004 is a UK-based threat actor that used Anthropic's Claude to develop, market, and distribute ransomware as part of a Ransomware-as-a-Service (RaaS) operation. Active since at least January 2025 on dark web forums including Dread, CryptBB, and Nulled, the actor sold packages priced from $400 to $1,200, including a full RaaS kit with a PHP console and command-and-control tools. The ransomware uses ChaCha20 encryption with RSA key management, EDR evasion through direct syscalls (FreshyCalls and RecycledGate), and shadow copy deletion. Anthropic assessed that the actor appeared unable to implement or troubleshoot these components without AI assistance.",
+      "meta": {
+        "country": "GB",
+        "refs": [
+          "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf"
+        ]
+      },
+      "uuid": "488356ae-4d96-4c3c-958e-2216849f62f6",
+      "value": "GTG-5004"
     }
   ],
   "version": 351

From 38696226587f66b5c97c68c4078316c37635b5f8 Mon Sep 17 00:00:00 2001
From: nicolaiprodromov <57862822+nicolaiprodromov@users.noreply.github.com.>
Date: Thu, 1 Oct 2026 09:54:39 +0300
Subject: [PATCH 2/2] [threat actors] Update README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index f72ac9cf..e9f812be 100644
--- a/README.md
+++ b/README.md
@@ -824,7 +824,7 @@ Category: *threat-actor* - source: *https://www.publicsafety.gc.ca/cnt/_xml/lstd
 
 [Threat Actor](https://www.misp-galaxy.org/threat-actor) - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group.
 
-Category: *actor* - source: *MISP Project* - total: *1057* elements
+Category: *actor* - source: *MISP Project* - total: *1059* elements
 
 [[HTML](https://www.misp-galaxy.org/threat-actor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/threat-actor.json)]