Threat Pulse 62High
CrowdStrike: four crews ran Claude Code-driven intrusions, hitting 15 Argentine hospitals
Severity 6ActiveconfirmedHealthcareGovernmentAI-related

CrowdStrike documented four operators (Spanish, Chinese, Indonesian and Russian speaking) who ran intrusions between May and August with Claude Code harnesses built on PentestGPT, claude-red skills and MCP servers. One breached at least 15 Argentine healthcare organizations and stole medical records; others hit government domains in several countries, a US CRM vendor and SaaS firms. CrowdStrike expects low-skill actors to reach state-level effectiveness within 12 months.

What to do: Campaigns documented May to August 2026; operators remain active.

AI angle: Operators accessed Claude via proxies and reframed refusals as authorized red teaming; all four used Claude Code as the agent.

· 15 days ago · 15+ Argentine healthcare entities, 20+ named global targets, several governments · CrowdStrike
SourcesCrowdStrikeCXO Today
Why this score

Dozens of victims across several countries (impact 2), successful intrusions (exploitability 3), healthcare and government touched (criticality 1).

Back to the board

Updated Nov 5, 01:46 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.