China-Linked Intrusion Campaign Used Claude Code and DeepSeek Against Governments

Researchers uncovered an active cyber espionage campaign tied to TencShell infrastructure in which suspected China-linked operators used commercial AI tools as live components of intrusions against government targets in Afghanistan, Thailand, Taiwan, and the United States, while also targeting financial services organizations across Europe, Australia, and Asia. Evidence recovered from an exposed directory on 112.213.124[.]132 included victim source code, phishing pages, exploit scripts, malware, and operator logs, alongside a CLAUDE.md file that documented a split workflow: Claude Code handled execution, persistence, automation, and phishing-page iteration, while DeepSeek-v4-pro was used for reasoning, exploit adaptation, evasion logic, and script generation.

Investigators linked the activity to a broader cluster of 13 Hong Kong-based servers across four ASNs and found overlap with both TencShell and a possible parallel framework called Gshell. The campaign used techniques including SQL injection, deserialization-based RCE, CORS exploitation, credential harvesting, phishing infrastructure, and webshell deployment, with one key node reportedly hosting ARL, DeepAudit, Vshell, and thousands of stolen or operational files. Researchers said the combination of Simplified Chinese artifacts, infrastructure patterns, and victimology strongly indicates a China-based state-aligned threat actor, marking a notable shift from AI-assisted research to direct operational use of commercial AI systems during hands-on attacks.