[threat-actors] Add GTG-2002 and GTG-5004

README.md

@@ -824,7 +824,7 @@ Category: *threat-actor* - source: *https://www.publicsafety.gc.ca/cnt/_xml/lstd
 
 [Threat Actor](https://www.misp-galaxy.org/threat-actor) - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group.
 
-Category: *actor* - source: *MISP Project* - total: *1057* elements
+Category: *actor* - source: *MISP Project* - total: *1059* elements
 
 [[HTML](https://www.misp-galaxy.org/threat-actor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/threat-actor.json)]
 

clusters/threat-actor.json

@@ -24342,6 +24342,27 @@
       ],
       "uuid": "b687defa-308c-4f9e-bb9e-d9d30fb4b1a0",
       "value": "Storm-2992"
+    },
+    {
+      "description": "GTG-2002 is a cybercriminal actor that used Anthropic's Claude Code to run a scaled data theft and extortion operation, which Anthropic described as \"vibe hacking\". The actor affected at least 17 organizations across government, healthcare, emergency services, and religious institutions. The actor stored its preferred tactics in a CLAUDE.md file and had Claude Code automate reconnaissance, credential harvesting, network penetration, and the creation of obfuscated versions of the Chisel tunneling tool. Instead of encrypting systems, GTG-2002 threatened to publish stolen data, using Claude to analyze victims' financial data and generate tailored HTML ransom notes demanding $75,000 to $500,000 in Bitcoin.",
+      "meta": {
+        "refs": [
+          "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf"
+        ]
+      },
+      "uuid": "3e77cffc-8041-483f-acff-c28698f0331b",
+      "value": "GTG-2002"
+    },
+    {
+      "description": "GTG-5004 is a UK-based threat actor that used Anthropic's Claude to develop, market, and distribute ransomware as part of a Ransomware-as-a-Service (RaaS) operation. Active since at least January 2025 on dark web forums including Dread, CryptBB, and Nulled, the actor sold packages priced from $400 to $1,200, including a full RaaS kit with a PHP console and command-and-control tools. The ransomware uses ChaCha20 encryption with RSA key management, EDR evasion through direct syscalls (FreshyCalls and RecycledGate), and shadow copy deletion. Anthropic assessed that the actor appeared unable to implement or troubleshoot these components without AI assistance.",
+      "meta": {
+        "country": "GB",
+        "refs": [
+          "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf"
+        ]
+      },
+      "uuid": "488356ae-4d96-4c3c-958e-2216849f62f6",
+      "value": "GTG-5004"
     }
   ],
   "version": 351