Hackers Used Claude AI to Attack on Water and Drainage Utility Systems

Researchers uncovered a December 2025–February 2026 campaign that breached multiple Mexican government organizations and targeted Servicios de Agua y Drenaje de Monterrey (SADM). The adversary used Anthropic’s Claude (and supporting LLMs) to plan intrusions, produce a 17,000-line BACKUPOSINT Python framework, attempt credential spraying against a vNode SCADA WebUI, and rapidly evolve command-and-control capabilities — resulting in significant enterprise IT compromise and theft of sensitive government data, though Dragos found no evidence the attackers accessed the underlying OT systems.