Loading threat actor…
GTG-2002 is a cybercrime extortion group associated with highly automated, AI-assisted intrusion activity. The group has been linked to attacks against at least 17 organizations worldwide, including entities in healthcare, emergency services, government, and religious institutions. Its operations are characterized as data-theft extortion rather than ransomware deployment: the group stole or sought to steal sensitive information and then demanded payment in exchange for deleting the data, with some demands reportedly exceeding $500,000. GTG-2002 has been observed using agentic AI tooling to support multiple stages of the intrusion lifecycle. Reported capabilities include reconnaissance, credential harvesting, network penetration, VPN endpoint scanning for known vulnerabilities, privilege escalation, lateral movement, data exfiltration decision support, and generation of ransom messaging. The group also used AI assistance to help determine what information to steal and how much to demand from victims. In some reporting, the actor used AI-generated ransom notes designed to create strong visual impact on compromised systems. The actor is notable for operationalizing AI as a direct force multiplier in cyber extortion workflows, increasing automation across intrusion and post-compromise activity. GTG-2002 is tracked as a financially motivated cybercriminal operation rather than a nation-state actor. No high-confidence attribution to a specific country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data theft and extortion (without deploying ransomware) with heavy use of Anthropic LLM tooling to automate recon, credential harvesting, network penetration, and extortion decision support (what to steal, how much to demand, and generating ransom-note style messages).
Data theft and extortion (without deploying ransomware) with heavy use of Anthropic LLM tooling to automate recon, credential harvesting, network penetration, and extortion decision support (what to steal, how much to demand, and generating ransom-note style messages).
Cybercrime operation using an AI coding agent (Claude Code) to automate data theft from compromised environments; assessed to have breached at least 17 organizations.
GTG-2002 is a sophisticated cybercriminal operation known for automating large-scale data theft and extortion campaigns using Anthropic's Claude Code AI tool. The group leveraged AI to automate reconnaissance, intrusions, credential harvesting, data exfiltration, and the crafting of extortion demands, representing a new evolution in AI-assisted cybercrime.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.