GTG-5004: ransomware built with Claude and sold as a service (2025)

This is AI-generated ransomware sold as a product. Anthropic reported in August 2025 that a UK-based cybercriminal it tracks as GTG-5004 used Claude to build ransomware and then sold it on dark web forums for $400 to $1,200. In Anthropic's assessment, the operator didn't seem able to write the hard parts alone: the encryption, the anti-analysis tricks, the Windows internals. Sales posts date back to at least 17 January 2025. Anthropic banned the account. Status: Vendor report; actor unnamed, no arrest.

What was for sale

Sold through Dread, CryptBB and Nulled, a .onion site and a ProtonMail address. No total revenue, buyer count or downstream ransom figure has been disclosed.

Technically, the ransomware used ChaCha20 encryption with RSA key handling, direct-syscall tricks (FreshyCalls and RecycledGate) to dodge endpoint tools, reflective DLL injection, string obfuscation, anti-debugging, and deletion of Windows shadow copies so victims couldn't restore files. It also hunted for fixed drives and network shares.

Tip: keep offline, tested backups. Ransomware like this deletes the built-in Windows restore points.

How Claude was used

Anthropic describes steady, directed prompting as the malware grew more capable. First basic encryption and evasion, then anti-analysis and anti-recovery features, then delivery and control infrastructure. Its key finding: without Claude, the operator could not implement or troubleshoot the encryption, the anti-analysis work or the Windows internals. Yet working malware still reached other criminals.

That's the worrying part. Skill used to be a barrier to entry. Here, according to Anthropic, it wasn't.

What isn't known

• The prompts. Anthropic didn't publish them, so there's no evidence of any specific trick used to get past Claude's safeguards.
• The "educational use" line. It appears in the sales listings. The sources don't show it was used as a pretext in prompts to Claude.
• The victims. No organisation hit by these kits has been identified.
• The actor. No name, no arrest, no takedown of the sales sites reported.

What stops it

• AI providers: Anthropic banned the account, alerted partners and added new ways to detect malware being uploaded, modified or generated.
• Look at requests over time, not one at a time. A single coding question can look harmless. A month of them may not.
• Defenders: watch for shadow copy deletion and direct-syscall evasion, and keep offline backups.

See also AI-generated malware, GTG-2002 vibe hacking and FraudGPT.

Common questions