Sophistication (S) = autonomy + adaptivity + dependence + stage coverage + capability weight, on an absolute scale. Each dot is one operation; boxes span the middle half of a quarter and whiskers its full range. Pick a layer to compare groups: dots move to their reporting dates, boxes drop away and each group gets its own line.
China’s GTG-1002 Tricks Claude Code Into Running 80–90% of Espionage Intrusions Against ~30 Tech, Finance, Chemical and Government Targets
Sophistication
22.6
Actor
GTG-1002
Model
Claude
Sector
Government, Financial services, Software/Hardware, Chemical
Posing as pentesters, GTG-1002 ran Claude Code as an orchestrator splitting tasks among Claude sub-agents. These scanned target infrastructure, found an SSRF flaw and wrote the exploit, broke in, harvested credentials, m…
What the sources document actually happened to victims. One operation can carry several kinds of harm.
285 of 437 operations document realized harm (65%)152 none documented or not assessed
Financial loss by reporting date
Net money lost by victims, where the sources give a figure (46 of 94). Excludes attacker revenue and unpaid ransoms.
Net loss to victims, USD (log scale)
Sophistication Sunder 55 to 1010 to 1515+
5 more give only a range: 1 under $10k, 2 $10k to $1m, 2 $1m to $100m.
Operations are counted once each sub-incidents nested under a parent campaign are excluded. Corpus volume grows over time, so part of any upward movement reflects wider coverage rather than more activity. Sophistication is scored from each entry's description, impact and response fields.
Operations by targeted country: fewermorenone recorded
Drag to move around once zoomed in; double-click to zoom. Singapore, Mauritius, Vatican City are too small to show on this map.
China
Russia
North Korea
Iran