BACKUPOSINT v9.0 APEX PREDATOR
BACKUPOSINT v9.0 APEX PREDATOR is a 49-module Python malware developed entirely by Anthropic’s Claude Code as part of the AI-Assisted Breach of Mexico's Government Infrastructure campaign. BACKUPOSINT v9.0 APEX PREDATOR leverages publicly available techniques for network enumeration, credential harvesting, Active Directory interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement [1].
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1548 | .003 | Abuse Elevation Control Mechanism: Sudo and Sudo Caching |
BACKUPOSINT v9.0 APEX PREDATOR has the ability to leverage |
| Enterprise | T1059 | .009 | Command and Scripting Interpreter: Cloud API |
BACKUPOSINT v9.0 APEX PREDATOR has leveraged OpenAI’s GPT-4.1 API to analyze extracted data.[2] |
| Enterprise | T1609 | Container Administration Command |
BACKUPOSINT v9.0 APEX PREDATOR can interact with and execute Docker and Kerberos commands.[1] |
|
| Enterprise | T1555 | .006 | Credentials from Password Stores: Cloud Secrets Management Stores |
BACKUPOSINT v9.0 APEX PREDATOR has a module that gathered Cloud Secrets Management Stores from password vaults within Microsoft Azure, Amazon Web Services (AWS) and Google Cloud Platform (GCP).[1] |
| Enterprise | T1567 | Exfiltration Over Web Service |
BACKUPOSINT v9.0 APEX PREDATOR has exfiltrated data using OpenAI’s GPT-4.1 API.[2] |
|
| Enterprise | T1683 | Generate Content |
BACKUPOSINT v9.0 APEX PREDATOR has created a skills file titled |
|
| Enterprise | T1046 | Network Service Discovery |
BACKUPOSINT v9.0 APEX PREDATOR has enumerated the ports on victim systems within the victim environment.[2] |
|
| Enterprise | T1135 | Network Share Discovery |
BACKUPOSINT v9.0 APEX PREDATOR has the ability to identify NFS and SMB shares within the victim environment.[1] |
|
| Enterprise | T1057 | Process Discovery |
BACKUPOSINT v9.0 APEX PREDATOR has the ability to enumerate the processes running within the victim environment.[2] |
|
| Enterprise | T1090 | .002 | Proxy: External Proxy |
BACKUPOSINT v9.0 APEX PREDATOR has connected to compromised servers within the victim environment via SOCKS proxies.[2] |
| Enterprise | T1018 | Remote System Discovery |
BACKUPOSINT v9.0 APEX PREDATOR has performed remote system discovery mapping harvested credentials to systems within the target environment.[2] |
|
| Enterprise | T1053 | .003 | Scheduled Task/Job: Cron |
BACKUPOSINT v9.0 APEX PREDATOR has the ability to abuse Sudo/Cron for privilege escalation.[1] |
| Enterprise | T1528 | Steal Application Access Token |
BACKUPOSINT v9.0 APEX PREDATOR has the ability to steal application tokens for CI/CD services to include Bamboo, Github, and Jenkins.[1] |
|
| Enterprise | T1082 | System Information Discovery |
BACKUPOSINT v9.0 APEX PREDATOR has discovered system configurations on victim devices.[2] |
|
| Enterprise | T1552 | .001 | Unsecured Credentials: Credentials In Files |
BACKUPOSINT v9.0 APEX PREDATOR has gathered credentials stored in configuration files.[2] |
| .003 | Unsecured Credentials: Shell History |
BACKUPOSINT v9.0 APEX PREDATOR has extracted system data to include histories.[2] |
||
| .005 | Unsecured Credentials: Cloud Instance Metadata API |
BACKUPOSINT v9.0 APEX PREDATOR has a module that is capable of gathering Cloud Instance Metadata to include AWS, Google Cloud Platform, and Azure.[1] |
||
Campaigns
| ID | Name | Description |
|---|---|---|
| C0064 | AI-Assisted Breach of Mexico's Government Infrastructure |
During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with generating and executing numerous Python scripts including BACKUPOSINT v9.0 APEX PREDATOR to achieve their objectives.[2] |