Claude Opus 4.7 & I Saved a 60 Person Company From Cyber-Annihilation

This post is free. Share it with anyone who builds, defends, or leads a security team.Substack is abuzz with "How to REALLY use AI", and they are cute primers on how to "Make Claude/ChatGPT Your Personal Assistant!". Allow me to show you the front lines of all out commercial cyber warfare, just a couple notches below military nation-state hacking.So you might know me as geopolitics guy. What most people don't realize is that the geopolitics work and the security work are the same job. Both are about understanding who has access to what, and what they do with it when no one's watching. I've been in IT and enterprise security for longer than most AI companies have existed. The analytical framework that maps Iranian command structures and financial warfare is the same one I apply to malware chains and HIPAA exposure. Different domain, identical methodology.AI makes me untouchable at this point, and it helps my brain run even deeper when creating novel yet evidence-based theses in geopolitics. I will explain as we go along. There's a human interest story at the end. I get a hug. Isn’t that good?A senior practitioner at an important client of mine emails in total panic. She cc'ed the Director of Finance, Clinical Director, plus the on-site IT guy. So it’s all hands on deck and they needed their IT assassin for hire, me, now. Her personal Amazon account was flooded with fraudulent orders. Her office and personal Gmail had dozens of inbox filter rules she didn't create. Someone was intercepting her fraud alert emails before she could see them. She had spent 3 days on the phone with Google, Amazon, UPS, and the in-house IT guy. Despite changing all her passwords a dozen times, orders were still going through Amazon. Mostly gaming PC's.Client x called on me calmly but I could tell beneath that, she was grasping at straws and desperate. She wasn't even thinking about HIPAA, she just needed to staunch the bleeding. And she knows more about HIPAA than I do.She needed me to look at her ThinkPad, two Macs, and Android phone, ASAP. I am calm under pressure, thankfully. By the end of the day with the new Claude Opus 4.7, I had:* Identified a two-stage malware chain* Reverse-engineered the RAT from Python bytecode* Traced the attack to a ClickFix social engineering campaign* Ran forensics via Tailscale + RDP without damaging the crime scene* Investigated lateral (network and propagation) movement* Wrote a formal HIPAA risk assessment under 45 CFR 164.402* Produced a complete remediation packageOne person. One afternoon. The same custom Anthropic Claude setup that I built over time that helps me automate my Iran war coverage and manages my 26,000-word Surkov investigation.As you can see, I don't need no stinkin' OpenClaw. That’s just the latest shiny AI toy. Claude's adherence to context and mission over long sessions is quite enough. You just have to have enough brains or experience or both to do this right. Because I had never done this before. Not to this submarine hull crushing depth.My paid Substack archives has 155+ footnoted investigations on geopolitics, AI, and power structures. $8/month.What Jane Doe ClickedThe attack vector was a "ClickFix" campaign. If you haven't seen one, here's how it works: a webpage displays a fake CAPTCHA that tells you to "verify you're human" by pressing Win+R, then Ctrl+V, then Enter. The page has already copied a malicious command to your clipboard. You think you're solving CAPTCHA. You're executing malware. (This only works on Windows, so for the love of Bill Gates' pedophile victims, please switch to Linux or macOS, I'm not always gonna be here to bail you all out.)In this case, the phishing page impersonated a LinkedIn HR workflow, hosted through `linked-[redacted].com`. The clipboard command used the `finger` protocol, a 1970s Unix utility that almost nobody uses anymore, which is exactly why attackers love it. Modern firewalls and endpoint detection systems rarely inspect `finger` traffic. It's so old it's invisible. It just tells you if a user is present on the system or when they were last logged in. Perfect to see if the victim is active.The command retrieved a PowerShell second stage that dropped two independent malware modules into `C:\ProgramData\`:Component A: Credential Stealer. A Python script bundled with its own portable Python 3.9.5 runtime, SQLite libraries, and OpenSSL, the Python itself disguised with PyArmor so antivirus won't pick it up. Package one, and it's already a full-blown stack with a database, hidden app, and fake security certs at the ready. It extracts saved passwords and session cookies from Chrome and Edge via Windows DPAPI. Session cookies are more valuable than passwords because they bypass two-factor authentication entirely. The attacker doesn't need your password or your authenticator app. They have the cookie that says "this person already logged in." Game over.She couldn't bear to be in the room when I started forensic analysis and diagnosing but when I showed her exhibit A, she wasn't surprised but definitely crestfallen.Component B: Full Remote Access Trojan, a.k.a. RAT. This is called "GETTING COMPLETELY OWNED". An unobfuscated Python 3.10 bytecode file (`main.pyc`) bundled with both x86 and x64 Python runtimes so it works on any Windows machine. It connects to `crewlcrewlcrewl.com` over a WebSocket with TLS certificate validation disabled, maintaining a persistent, encrypted, bidirectional command channel that looks like normal web traffic in network logs.The RAT's command surface, recovered through bytecode string analysis:* `EXEC_IN_MEM`: Load and execute arbitrary code directly in memory without ever touching disk (defeats file-based antivirus completely)* `S_POWERSHELL` / `S_PS1`: Execute PowerShell commands from the C2 server* `S_UPLOAD`: Exfiltrate files from the victim's machine* `loadpescript`: Download and run additional Python modules* `msiexec /quiet /qn`: Silently install Windows software packages* `rundll32`: Load and execute attacker-supplied DLLs* `SelfDelete` / `SelfRunAndWait`: Self-destruct to destroy evidenceBoth components persisted through a scheduled task named `AndronichAdultMegaLodong` (yes, really) and a Startup folder shortcut. Dual redundant persistence: kill one, the other brings it back at next logon.The malware was installed on [redacted]. It ran for 22 days before anyone noticed. The attacker used stolen session cookies to access Gmail (where they created inbox filter rules to intercept fraud-alert emails and redirect them to trash) and Amazon (where they placed fraudulent orders). But the RAT gave them the capability to do far more. `EXEC_IN_MEM` means they could run anything, anytime, invisibly.By this point, she's watching every one of my fast and furious keystrokes and shortcuts and voice prompts with a mix of awe and a look that defendants have before the jury announces a verdict.How I Investigated ItI went to the office and worked directly on the compromised machine. However, I kept an air gap between me and the evidence with Tailscale, a peer-to-peer WireGuard networking mesh, so I could continue the investigation without opening any ports to the internet. Just my Mac and her ThinkPad. No TeamViewer. No AnyDesk. No Chrome Remote Desktop. Those are literally the same tools attackers use, and installing them on a compromised machine makes your investigation indistinguishable from the intrusion.In fact I disabled any internet connectivity immediately, and set up a bogus internal network, no router even, just hard-coded static IPs.Tailscale gives you an encrypted tunnel with no public surface, MFA at the identity layer, and RDP bound to the mesh only. The standard remote access tools are a liability on a breached box. Tailscale is not.I wrote PowerShell and Bash collection scripts (I run Mac usually, but I run Linux, FreeBSD, and sometimes Windows on the regular) with Claude and ran them against the live system. Note that I resisted the common urge to quarantine or destroy the malware. That's not how this works. In real forensic Incident Response the whole system is evidence. Wiping the laptop would have been like cleaning up Ground Zero and shipping WTC 1 & 2 to China the day after 9/11, because that's what they did. Anyway, I did this:* Triage scripts: Pulled system info, user accounts, autoruns, scheduled tasks, Defender scan history, RDP configuration, PowerShell execution history* Payload collection scripts: Forensically preserved both malware components with hashes* Lateral movement investigation: Checked for spread to two of her Mac systems that she also operated* Evidence preservation: Collected file listings, profile inspection data, registry keys, all timestamped and hashedEvery script was written with Claude Opus. Not generated blindly and copy-pasted. Written interactively, tested against the live compromised system, refined when the first approach didn't capture what I needed, and documented as I went. The session log is 4.2MB of back-and-forth between me and the AI, covering everything from "write a PowerShell script to enumerate scheduled tasks with their actions and triggers" to "this patient has PHI on the machine, draft a four-factor HIPAA risk assessment under 45 CFR 164.402." (Ok, I had to do a few internet searches on which CFR's applied here.)What the RAT Actually Does (Bytecode Analysis)Full decompilation wasn't needed. String extraction from the `.pyc` bytecode was enough to map the entire command surface, C2 (Command and Control) infrastructure, and persistence mechanism.There is no way I can explain this in real-time to the client, nor would she understand. I am more concerned about bedside manner, trying to look calm while furiously strategizing on how to capture all the forensics.Architecture-aware dropper. The RAT ships both x86 and x64 Python runtimes and picks the right one at startup. The victim doesn't need Python installed. The malware brings its own.WebSocket C2 with failover. Primary server `crewlcrewlcrewl.com` over TLS WebSocket, with certificate validation disabled (`ssl.CERT_NONE`) so the malware connects to any server presenting any certificate. The WebSocket protocol makes the traffic look like a legitimate web application (chat, live updates) in network logs.Reflective PE (Portable Executable) loader. This is the scary one. "Reflective" means the malware loads and runs an executable entirely in memory, never saving it as a file on disk. The `EXEC_IN_MEM` handler asks Windows to reserve a chunk of memory (`VirtualAlloc`), writes attacker code into it, flips it to executable (`VirtualProtect`), and runs it. Your antivirus scans files. This never becomes a file. It's like a burglar who breaks into your house, does everything he needs to, and leaves without ever touching the floor. Your alarm system checks the doors and windows. He came through the ceiling.Named pipe IPC (Inter-Process Communication). The RAT and the credential stealer are two separate programs that talk to each other through a hidden channel called a "named pipe" (`\.\pipe\PipePipe!`). Two burglars in the same house communicating through the walls by knocking. One steals the passwords, the other provides remote control, and they coordinate through a channel most monitoring tools don't even know to listen for.Bytecode compile timestamp: 2025-03-07. Over a year old. Not bleeding-edge, not state-sponsored. Commodity malware, the kind you can buy off the shelf in the right forums. Consumer antivirus (McAfee, in this case) missed it for 22 days because the execution chain (finger protocol to PowerShell to Python bytecode to in-memory execution) is a series of individually legitimate tools strung together in a way that never trips the signatures antivirus looks for. Each step looks normal. The combination is lethal. It's like building a bomb from items you bought at a hardware store. No single purchase raises a flag.To be honest the attackers are probably high school students. If they were pros, they would have used the same Python versions in both malwares, because pros be like that. Kids just have to know where to buy this dark web ware and how to tweak it. Obviously I'm not going to tell you how to do this. Your kids will, if you employ legally justified corporeal punishment. Please laugh.The client is somewhat relieved that I have contained the damage and that none of the other computers or network infrastructure has been breached or damaged, as far as I can tell. The boss comes in and she is talking a million miles an hour about what she should do, what the company should do, what legal should do, what compliance should do, and she just keeps cycling herself. It's just how she is depressurizing from a high stakes gambit that could have wiped out the entire company had the malware extended itself. She is talking so fast and so much that I have to tune her out to get the job done.HIPAA Complication (Are we going out of business?)The compromised machine belonged to said clinician at a large psychological practice. The ThinkPad contained:* Several thousand patient-identifiable evaluation reports over 11 years* IQ score reports, insurance billing spreadsheets with client identifiers* Evaluation records spanning 2021 through 2024* A complete backup of an earlier work driveThis made the investigation a potential HIPAA breach notification event under 45 CFR 164.402. I wrote a formal four-factor risk assessment:Factor 1 (Nature of PHI, Patient Health Information): Substantial. Several thousand patient-identifiable clinical documents spanning 11 years.Factor 2 (Who accessed it): Unknown actor operating a financially-motivated RAT. Observed behavior (Gmail filter tampering, Amazon fraud) is consistent with opportunistic consumer-account fraud, not targeted medical data theft.Factor 3 (Was PHI actually acquired or viewed): Quantitative analysis of outbound traffic patterns establishes an upper bound inconsistent with bulk exfiltration. Selective access to individual files cannot be affirmatively excluded due to gaps in the host's audit configuration.Factor 4 (Mitigation): Host isolated, malicious task disabled, credentials being rotated from clean device, full OS reinstallation planned. (But not until investigation and HIPAA outcomes determined. Laptop is impounded for now with RAM and network states written to files.)Conclusion: Low probability of PHI compromise, but the determination cannot reach certainty because the RAT's `S_UPLOAD` capability means selective file exfiltration was technically possible during the 22-day window, and the host's logging was insufficient to prove it didn't happen.This document was written to stand alone for handoff to legal counsel, the practice's HIPAA Privacy Officer, or HHS/OCR inquiry. It took about 45 minutes with Claude Opus structuring the analysis against the regulatory framework while I provided the forensic findings.DeliverablesBy end of day, the victim and her practice had:Document | Purpose -------------------------+----------------------------------------------- Full incident report | Complete timeline, attack chain, IOCs, | evidence inventory RAT technical analysis | Deobfuscated command surface, C2 protocol, all | IOCs HIPAA risk assessment | Four-factor analysis under 45 CFR, ready for | legal/insurance Credential reset runbook | Step-by-step account recovery for every | compromised service Device wipe runbook | Clean OS reinstall instructions Mac triage procedure | Lateral movement check for workplace machines Mobile device checklist | Phone and tablet review procedure IR playbook | Lessons learned and reusable incident response | template Forensic technique | How the remote collection was conducted, for documentation | reproducibility 12 forensic collection | PowerShell and Bash, all documented, all scripts | reusableOne person. One afternoon. No SOC. No team. No retainer. No $400/hour incident response firm.What This ProvesI'm not writing this to flex (well, maybe a little, this was a 6-man job that takes months that I did in 5 hours). I'm writing it because the implications matter for how security work gets done in the AI agent age, and Claude Opus 4.7, it gets the job done for me. I've been using Claude since Sonnet 3.5 and every model, yes there are improvements, but not the ones reviewers tell you about. They don't tell you things like when Opus went from 4.0 to 4.5, it suddenly started testing its own code that it just wrote, on its own. I used to write rules, hooks, and skills to do that myself, automagically. BEFORE hooks and skills were a thing, I just made Bash and Python scripts. It used to entertain my techie friends, but now, it’s passé. It's really the tooling Anthropic makes that's as genius as their LLM's. In fact, it makes the LLM's like Opus 4.7 look a weeeee bit smarter than they probably are.I tell you real world results in the harshest of environments, the worst of threats. Other guys? They report software engineering benchmarks. Like does the normal person even know wtf SWE stands for? It doesn't matter. What matters is can it do the job or not.The traditional SOC model: a company gets breached, calls a $400/hour IR firm, waits 48 hours for an engagement letter, gets a team of 3-6 analysts who spend a week producing a report. Total cost: $30,000 to $100,000. Time to first finding: days.What happened with Claude and I: one person with years of IT experience, an AI coding partner, and a methodology that treats the AI as infrastructure (not as a replacement for judgment) produced the same deliverable set in hours. The AI wrote the PowerShell scripts. I told it what to look for. The AI structured the HIPAA assessment. I provided the forensic conclusions. The AI formatted the runbooks. I made the remediation decisions. This is far from AI slop or human slop. It's the best of both worlds. If I didn't know what I was doing, I would have simply nuked the laptop and gotten her files from backup, but that would have destroyed HIPAA compliance. Audits and fines would have ensued, absolute chaos giving everyone headaches and worse. I don't know if companies lose their ability to continue practicing, but I imagine if it's truly egregious HIPAA violations, maybe.The AI is not the investigator. I am. The AI is the analyst pool, the script writer, the document formatter, and the regulatory framework reference library. It does the work that would normally require three junior analysts and a paralegal. I do the work that requires decades of knowing what to look for and where to look.This is the same model that runs my newsletter. Claude doesn't write my Iran analysis. It processes OSINT channels 24/7, manages the publishing pipeline, generates social media posts, and handles the infrastructure. I write the arguments, make the editorial decisions, and take responsibility for every claim. The AI is the newsroom. I'm the editor-in-chief.The same session that reverse-engineered a RAT yesterday morning published a 4-part investigative series on Vladislav Surkov yesterday afternoon and shipped Day 48 of Iran war coverage last night. Three completely different domains. One person. One AI infrastructure. It’s not Claude. It’s me. Claude is just a tool for me. Opus 4.7 is so good that I am willing to sing Sweet Caroline at Fenway Park and I hate Neil Diamond’s voice. “SO GOOD! SO GOOD! SO GOOD!”The capability problem is solved. We have AI that can code, research, analyze, and produce at a level that was impossible for a solo practitioner two years ago. The question is not whether the tools work. The question is whether the person using them knows what to build.Here's the part that doesn't fit in a deliverables table.I've known this company for years. They invite me to the company Christmas party, just as I was an employee, even though I'm just a contractor. The victim, we'd never really talked beyond professional pleasantries. Five hours of fever pitched battle over a compromised machine and personal and company data changes that. Never mind her entire life savings. (She froze all her accounts and moved all her money.) By the end, she had a lot on her plate: 21 internet accounts still need password resets, a ThinkPad that needs wiping, a practice that needs to review its security posture. But the malware was identified, the attack chain was mapped, the HIPAA assessment was written, and the remediation plan was in the boss's hands. We were miles, months, ahead of where most practices would be at this stage.As I packed up to leave, I turned around and she said "Come here, let me give you a hug." I was so surprised! I was just doing my job. We hugged and I patted and soothed her on the back just to confirm everything was going to be okay. She was sooo relieved the situation was under control. That the HIPAA exposure, the thing that keeps every healthcare professional up at night, had been assessed before her insurer or her regulator even knew there was an incident.This is not the first time that's happened to me, but it's infrequent. Ultimately, deeds inspire people, not the technical details. It’s odd to say saving digital lives is the same as saving lives, but sometimes it feels like it to victims. So I get hugs, being a deadly accurate IT savior who thinks like an assassin. They are the same role to me. Just choose your side.Security Operation Centers don't get hugs. $400/hour IR firms don't get hugs. They send invoices and NDAs and do follow-up calls in six weeks. One person with the right tools and years of knowing what to look for gets a hug.The practice owner, who I consider a friend and ally, sat in for some of it, especially toward the end. He got his executive summary and knows he's got more than enough to handle what comes next. He joked, "Well, you are the man! We're gonna make 'You're the Man' bumper stickers!" I told him the HIPAA compliance people are going to be drowning in data. I generated over 7,000 files of planning documents, scripts, and reports in one afternoon. They'll have more documentation than most SOC breaches produce in a month.We all had a long bellowing stress-exhaling laugh after that!I have this habit to say something to myself after a day like this: "I didn't save the world today, but I saved someone's world."If we all could do that every day, isn't that a superpower? Would the world not be better? You don't need to reverse-engineer a RAT to save someone's world. You just need to show up when they're panicking and know what to do next. The AI helps me know faster. The career I have obviously helps me know what matters. The combination means one person can do what used to require a team, and the person on the other end gets a hug instead of an invoice. Plus the client and I will have something to laugh about at the next Christmas party. Crisis averted! Hooray!It's the photographer, not the camera. (Yes, I am a professional photographer too. No, I am not bragging.) After a day like this, I'll allow myself one honest sentence: I might be the greatest IT guy to ever live, before or after AI. Earned it today.P.S. If this ever happens to you, don't shut down. Unplug the ethernet, disable Wi-Fi. Then call me.If you're interested in how I build these systems, I train people and organizations on AI, IT, and custom app workflows at every level. Reach out. If you want to see the geopolitical analysis these tools produce, the paid archive has 155+ footnoted investigations. $8/month.$8/month. Geopolitics, AI, cybersecurity, and systems analysis. No ads. No sponsors. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit tatsuikeda.substack.com/subscribe