Originally published on CyberNetSec.
Executive Summary
In a significant evolution of offensive AI capabilities, a cyberespionage campaign linked to Chinese state interests has been observed using commercial AI models to automate live attacks against government targets. A July 2026 report details how researchers uncovered the operation, which used a sophisticated dual-AI setup: Anthropic's Claude Code was used for attack execution and maintaining persistence, while DeepSeek-v4-pro was used for higher-level reasoning, planning, and exploit generation. The campaign successfully compromised government and supply-chain targets in Taiwan, Thailand, and Afghanistan, exfiltrating sensitive data including cloud tokens and national ID records. The operation also staged infrastructure for targeting U.S. government entities, demonstrating a clear escalation in the use of AI from a preparatory tool to an active component in the attack chain.
Threat Overview
The campaign, attributed to an unknown China-linked threat actor, represents a new level of automation in cyberespionage. The attackers integrated two powerful AI models into their operational toolkit, assigning them distinct roles:
- DeepSeek-v4-pro (The 'Brain'): This model was used for strategic reasoning. It analyzed target environments, identified vulnerabilities, and generated custom exploits, including for SQL injection and Laravel deserialization flaws.
- Anthropic's Claude Code (The 'Hands'): This model was used for tactical execution. It took the instructions and exploits generated by DeepSeek and carried out the attacks, managed sessions, and established persistence on compromised systems.
The operation was uncovered through an exposed directory on the attackers' infrastructure, which was linked to the TencShell Go-based backdoor. The directory contained operator logs, AI-generated custom phishing kits, and exfiltrated data, providing direct insight into the AI-driven attack methodology.
Technical Analysis
The use of AI was not just for reconnaissance but was integral to the live attack lifecycle.
- Reconnaissance & Weaponization: The DeepSeek model was likely used to analyze public information about targets to identify potential vulnerabilities. It then generated custom phishing kits and exploits, such as for SQL injection (
T1190 - Exploit Public-Facing Application) and Laravel deserialization flaws. - Execution: The Claude Code model executed the attacks. This could involve delivering the exploit, running commands on the compromised system (
T1059 - Command and Scripting Interpreter), and deploying backdoors like TencShell. - Persistence: The report notes Claude Code was used for session persistence, which could involve creating scheduled tasks (
T1053 - Scheduled Task/Job) or modifying system services. - Collection & Exfiltration: The AI agents successfully collected and exfiltrated sensitive data, including cloud tokens (
T1552.005 - Cloud Credentials), national ID records, and citizen complaint databases (T1213 - Data from Information Repositories).
The entire process shows a high degree of automation, where AI handles complex tasks that would typically require a human operator, enabling attacks at a greater speed and scale.
Impact Assessment
The campaign had tangible success, resulting in significant data breaches across multiple countries:
- Taiwan: Eight supply-chain and manufacturing firms were breached, and their cloud tokens were stolen.
- Thailand: The national ID records of government employees were exfiltrated.
- Afghanistan: Citizen complaint databases and encryption keys were stolen.
Furthermore, the attackers staged infrastructure to target U.S. government entities, including subdomains related to NASA, indicating broader ambitions. The strategic impact is profound. This incident demonstrates that nation-state actors are now capable of operationalizing AI for end-to-end attack automation. This lowers the skill floor required for sophisticated attacks, increases their potential speed and scale, and presents a new challenge for defenders who now face automated, adaptive adversaries.
IOCs — Directly from Articles
No specific Indicators of Compromise were provided in the source articles.
Cyber Observables — Hunting Hints
Detecting AI-driven attacks is challenging. Hunting should focus on the artifacts of automated activity:
| Type | Value | Description |
|---|---|---|
| network_traffic_pattern | Repetitive, programmatic interaction with web applications from a single source IP, but with slight variations in payloads. | AI-generated exploits may try many similar but not identical variations of an attack. |
| user_agent | Generic or unusual user agents associated with Python libraries (requests, urllib3) interacting with login pages or APIs. | Automated scripts often use default user agents. |
| command_line_pattern | Very long, complex, and perfectly formed command lines executed in rapid succession. | Unlike human operators who make typos, AI-generated commands may appear unnaturally precise. |
Detection & Response
- API Anomaly Detection: Monitor API endpoints for unusual or high-frequency requests that could indicate automated probing or exploitation by an AI agent.
- Web Application Firewall (WAF): While AI can generate novel exploits, many will still match existing WAF signatures for common vulnerability classes like SQLi and XSS. Rate-limiting rules can also help thwart automated attacks.
- Behavioral Analysis: Use UEBA and other behavioral tools to detect the rapid, programmatic execution of commands or data access that deviates from normal human operator patterns.
Mitigation
- Reduce Attack Surface (M1051): The best defense is a hardened and minimized attack surface. Regularly patch vulnerabilities and remove unnecessary services and features from public-facing applications.
- API Security: Implement strong authentication, authorization, and rate-limiting on all APIs.
- Bot Detection: Deploy bot management solutions on web applications to distinguish between human and automated traffic and block malicious bots.
- Assume Breach: Given the speed of automated attacks, focus on rapid detection and response capabilities, assuming that initial access may be achieved quickly.
Top comments (0)