Loading story…
A Chinese-speaking operator used the SecFlow framework to orchestrate AI agents associated with Claude, Qwen, and DeepSeek in intrusion activity against government, education, industrial, and telecommunications organizations across Asia. The agents automated reconnaissance, testing of known vulnerabilities, credential collection, and reporting, while conventional tooling—including webshells, stolen credentials, custom implants, GLUTTON tooling, and shared SOCKS infrastructure—carried out the intrusions. Researchers linked activity through reused accounts, niestools.com services, SecFlow artifacts, and the recurring handle “Nie.”
The most severe confirmed breach affected a Fengtai District government Office Automation environment, where the operator obtained Windows command execution, captured LSASS memory and registry hives, extracted OA accounts and records, created a privileged application account, exfiltrated government and health data, and deployed the SecBox implant. A Chinese education AI platform’s control and data plane were also compromised; other targets included Taiwan’s Kuomintang archives, Indonesia’s Ministry of Foreign Affairs, Vietnamese organizations, Chinese public-service systems, and an Afghan telecommunications operator. Workflows tested eight known flaws, including Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus traversal vulnerabilities, and a Nacos authentication bypass, though not all exploitation attempts succeeded.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Hunt.io published its TLP:AMBER findings after sharing them with relevant national CERTs and delaying public release. The report linked five exposed operator workspaces through shared SOCKS infrastructure, SecFlow and GLUTTON artifacts, reused accounts, payload relationships, and the recurring handle "Nie."
A MySQL-compatible server hosted at 159.223.64[.]67 delivered Java deserialization payloads intended to execute on vulnerable connecting Java clients and download Linux SecBox-compatible implants from 129.211.184[.]149:8443.
An unauthenticated management backend exposed agent configurations, secrets, internal addresses, and 104 complete AI-dialogue records. The operator successfully used exposed Dify, Coze, and other credentials against the production Dify API to obtain 169 conversations and 339 message or query entries, including student information; an unauthenticated agent-configuration write was also confirmed.
The actor deployed the customized Go-based SecBox remote-access and network-pivot implant through ASPX downloaders and loaders. SecBox supported command execution, file transfer, credential and token access, discovery, scanning, SOCKS proxying, port forwarding, and self-removal.
The operator gained server-side Windows command execution through an internet-facing IIS Office Automation FileManage handler, then used webshells for discovery, database access, credential theft, lateral movement, and exfiltration. They collected a roughly 75.8 MB LSASS dump and SAM/SYSTEM hives, extracted 822 OA account records, created an elevated OA application account, and accessed government, health, and patient-related records.
The SecFlow-enabled campaign targeted Taiwan's Kuomintang Party History Archives and Indonesia's Ministry of Foreign Affairs, alongside organizations in other Asian sectors. The reference characterizes these as targets and does not confirm a compromise of either organization.
A Chinese-speaking operator used the SecFlow orchestration framework with Claude, Qwen, and DeepSeek model profiles to automate reconnaissance, exploitation, credential collection, and reporting against organizations across Asia. The activity used conventional exploits and tooling, including tested or staged paths for eight known CVEs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecommunity.gurucul.com
Open sourcesecurityaffairs.com
Open sourcecyberveille.ch
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered an active cyber espionage campaign tied to **TencShell** infrastructure in which suspected China-linked operators used commercial AI tools as live components of intrusions against government targets in **Afghanistan, Thailand, Taiwan, and the United States**, while also targeting financial services organizations across Europe, Australia, and Asia. Evidence recovered from an exposed directory on `112.213.124[.]132` included victim source code, phishing pages, exploit scripts, malware, and operator logs, alongside a `CLAUDE.md` file that documented a split workflow: **Claude Code** handled execution, persistence, automation, and phishing-page iteration, while **DeepSeek-v4-pro** was used for reasoning, exploit adaptation, evasion logic, and script generation. Investigators linked the activity to a broader cluster of **13 Hong Kong-based servers** across four ASNs and found overlap with both **TencShell** and a possible parallel framework called **Gshell**. The campaign used techniques including **SQL injection**, **deserialization-based RCE**, **CORS exploitation**, credential harvesting, phishing infrastructure, and webshell deployment, with one key node reportedly hosting **ARL**, **DeepAudit**, **Vshell**, and thousands of stolen or operational files. Researchers said the combination of Simplified Chinese artifacts, infrastructure patterns, and victimology strongly indicates a **China-based state-aligned threat actor**, marking a notable shift from AI-assisted research to direct operational use of commercial AI systems during hands-on attacks.
Jul 16, 2026
Dream reported that attackers used the open-source AI agent frameworks **Hermes** and **OpenClaw** to conduct a near-autonomous intrusion against government entities in Asia, compromising **85 employee accounts** and stealing at least **2,500 personnel records**. The campaign unfolded in **12 attack waves** and used up to **eight parallel sub-agents** to automate reconnaissance, credential attacks, API testing, data collection, and lateral movement at machine speed. The attackers reportedly mapped **21 connected government systems** and exploited multiple server-side weaknesses, including unauthenticated APIs, insecure authentication endpoints, weak token validation, and acceptance of JWTs using the `none` algorithm. Dream said the operation harvested employee identifiers from exposed APIs, used OCR-assisted password spraying, and then reused compromised credentials through an SSO bridge to reach internal systems; an archive linked to the campaign also contained internal network ranges, **seven SSO client secrets**, and **six database credentials**. The operator was not identified, but Dream observed Chinese-language indicators in the activity, while public reporting linked the targets to Taiwan.
Aug 25, 2026
Researchers and government officials said a China-linked operation used open-source AI agent frameworks to conduct a near-autonomous intrusion campaign against Taiwan government and critical-sector organizations. The activity reportedly combined up to eight sub-agents built on **OpenClaw** and **Hermes** to automate reconnaissance, API enumeration, credential theft, vulnerability validation, lateral movement, persistence, and data exfiltration across 12 attack waves. Taiwan’s Ministry of Digital Affairs disclosed abnormal attacks with overseas origins, while reporting tied the campaign to compromises of 85 employee accounts, theft of roughly 2,500 personnel records, and targeting of agencies and suppliers including energy companies, a government email system, IT supply-chain vendors, and the nuclear safety sector. Separate reporting showed the same AI agent ecosystem is also being abused as a malware and credential-theft supply chain. In the **ClawHavoc** campaign, attackers poisoned more than 350 OpenClaw **ClawHub** skills disguised as legitimate tools, then used ClickFix-style lures and a fake **AuthTool** requirement to push infostealers and steal crypto wallets. Security researchers warned that autonomous agents can pair stolen credentials and session cookies with shared malicious skills, black-market exchanges, and prompt-injection techniques to bypass MFA, move laterally, and even deploy ransomware, turning widely available agent frameworks into a fast-scaling offensive platform and a new software supply-chain risk.
Aug 21, 2026