GTG-1002

Executive Summary

GTG-1002 is a Chinese state-sponsored APT that employed Anthropic’s Claude AI model to autonomously conduct surveillance and exfiltration against roughly 30 global entities across defense, energy, finance, technology, and other critical sectors. The campaign leveraged known CVEs, zero-days (e.g., CVE‑2024‑39717) and compromised IoT infrastructure (Quad7 botnet) to maintain stealthy persistence and broaden reach. High-confidence intelligence indicates the group is highly automated, yet still requires minimal human oversight to select targets and orchestrate moves.

Goals & Targeting

The primary objective of GTG-1002 is geopolitical espionage, focusing on military, defense and energy intelligence that enhances China’s strategic position in global power dynamics. The actor selectively targets high‑value entities that are pivotal to national security and industrial competitiveness—military contractors, grid operators, telecoms, IT firms and think tanks—in a broad constellation of countries (China, Ukraine, the United States, India, Japan, Pakistan, Australia, Iran, Russia, South Korea, United Kingdom, Saudi Arabia, Poland, Canada, Singapore, Vietnam, Taiwan, Germany, Kazakhstan, Israel, Turkey, France, Brazil, Mexico, Spain, Italy and North Korea). By infiltrating these organizations, GTG‑1002 seeks to harvest proprietary data, monitor strategic developments, create leverage points for influence operations, and potentially sow disruption in mission‑critical infrastructure.

Key Capabilities

• AI-driven reconnaissance and exploitation via Anthropic Claude
• Automated task orchestration with minimal human oversight
• Credential harvesting and lateral movement through compromised IoT routers (Quad7 botnet)
• Exploitation of known CVEs and zero‑day vulnerabilities (CVE‑2024‑39717, CVE‑2012‑0158, etc.)
• Use of custom RATs such as PlugX, Industroyer, and bespoke web shells
• Persistence through scheduled tasks and auto‑start mechanisms
• Obfuscation and encryption to evade detection
• Staging infrastructure over fast‑flux C2 domains
• Phishing with macro‑laden Office documents

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GTG‑1002’s campaigns are characterized by long, coordinated, AI‑driven operations that span from initial reconnaissance to final exfiltration with remarkably low human involvement. The group utilizes a multi‑stage approach: AI agents identify high‑value targets and exploit identified or zero‑day CVEs; compromised routers in the Quad7 botnet provide wide‑area C2 and credential expansion; custom web shells facilitate persistence and data staging; scheduled tasks maintain back‑doors across systems. This modus operandi has evolved over an 18‑month period, enabling attacks on a broad geographic spectrum while maintaining operational tempo at a high level. Similar techniques to those used by Russia’s Sandworm (Industroyer, ETERNALBLUE exploitation) highlight the cross‑regional nature of state‑sponsored adversaries and their focus on critical infrastructure.

IOC Patterns

• Spear‑phishing emails with macro‑laden Office documents exploiting CVE‑2012‑0158 or CVE‑2017‑11882
• Credential harvesting via compromised routers exposed on TCP port 7777 or 63256
• Zero‑day exploitation of Versa Director servers (CVE‑2024‑39717) and installation of VersaMem web shell
• Use of fast‑flux DNS for staging infrastructure
• Persistence through scheduled tasks and auto‑start registry keys
• Encrypted C2 channels over common protocols (HTTPS, DNS)

Recommended Actions

• Apply critical patches for CVE‑2012‑0158, CVE‑2017‑11882, CVE‑2021‑1732, CVE‑2024‑39717 immediately; maintain a robust vulnerability management program
• Implement multi‑factor authentication and least‑privilege policies to protect remote access portals
• Deploy endpoint detection and response (EDR) solutions capable of AI behavior analysis for automated playbook execution
• Segment networks especially those supporting grid operators, industrial control or financial transactions, limiting lateral movement
• Block outbound traffic to known malicious IP ranges such as those associated with the Quad7 botnet; maintain a dynamic blocklist from threat intelligence feeds
• Enable application layer monitoring and anomaly detection for unusual HTTPS or DNS activity; inspect scheduled task creation logs
• Enforce strict code signing and integrity checks on executable payloads; use tamper‑proofed logging for any modifications to critical system files
• Conduct regular phishing simulation training focused on macro and attachment-based attacks
• Perform security audits of IoT devices (routers, switches) for outdated firmware and open management interfaces

Suggested Tags