Summary
The UK National Cyber Security Centre and eight international partners issued a joint advisory naming Integrity Technology Group for enabling China-linked actors to target sensitive data globally [1]. Anthropic reports it banned an Iran-linked user who used its Claude model to build targeting guides on U.S. Navy personnel and assets [2]. Fox News reports that a California Navy veteran was fooled by an AI voice cloning scam into making a $5,400 wire transfer [3].
Main story: UK partners expose China firm enabling global data theft
The UK National Cyber Security Centre, alongside eight partners from six countries, issued a joint advisory identifying Integrity Technology Group as a key enabler for China-linked cyber actors. The advisory states that the company, which has links to the Chinese government, has allowed malicious actors to exploit networks and steal confidential data from organizations worldwide, including in critical sectors. The NCSC notes that these actors use AI-enabled tools for automated scanning, large-scale botnets, and manual exploitation techniques to compromise targets [1].
The report details how Integrity Tech employs individuals who develop tools for sale, acquire infrastructure, and directly compromise networks. The UK government sanctioned Integrity Tech last year for its role in malicious cyber activity against the UK and its allies. The advisory urges organizations to strengthen their cyber resilience and follow specific mitigation advice to defend against this evolving threat [1].
Paul Chichester, NCSC Director of Operations, stated that the breadth of targeted sectors demonstrates the extent of the threat. The advisory highlights that the company enables a range of malicious cyber activities that pose a significant threat. The partners emphasized that all organizations should take note of this warning and engage with NCSC advice and guidance [1].
Supplemental
Anthropic bans Iran-linked user targeting US Navy
Anthropic reports that it discovered and banned an unidentified user linked to Iran for using its Claude AI assistant to gather intelligence on U.S. naval forces. The company’s 154-page report, covering incidents from December to August, states the user used Claude to compile rosters of U.S. personnel from public military photos and collect ship and aircraft transponder identifiers. The actor also generated inventories of public websites exposing naval movements and directed the AI to compile vulnerability research on shipboard systems [2].
The report describes the creation of "targeting books" to identify and track Navy positions using open-source information [2]. Anthropic did not specify when it discovered the misuse. The disclosures follow recent Navy warnings urging personnel to remove details from social media that could reveal their affiliation and to report suspicious activity near bases [2].
AI voice clone tricks veteran into $5,400 wire
Fox News reports that Deborah Del Mastro, a California mother and Navy veteran, was fooled by an AI voice cloning scam into making a $5,400 wire transfer. The article states that Del Mastro received a call from a local number where a man claimed a Mexican drug cartel had kidnapped her 37-year-old daughter, Sarah. Del Mastro told the CyberGuy Report podcast that she heard her daughter’s voice crying and struggling to breathe, which made the threat feel real [3].
Del Mastro told a U.S. Senate committee that she remained "completely traumatized" by the experience [3]. The story notes that the voice on the phone matched her daughter’s familiar sound, which had been heard sobbing days earlier after a breakup [3].
References
- China-linked malicious actors called out by UK and international partners for targeting sensitive data globally · ncsc_uk · threat intel report · 2026-10-08 · RL-I-2026-0610 · archived
- Iran-linked actor used AI to build targeting guides on US Navy · www.stripes.com · threat intel report · 2026-09-11 · RL-I-2026-0465 · archived
- AI voice cloning scam fools Navy veteran mom into $5,400 wire transfer | Fox News · foxnews.com · threat intel report · 2026-10-07 · RL-I-2026-0594 · archived