Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
72
Threat actor
China-nexus threat actor
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 17, 2026
- Last mentionedSep 4, 2026
Timeline
3 articles · newest firstOperation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.
65
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
78
Related CVEs
by mentions- CVE-2026-593103%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-593098%9.8VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
Appears with
- Claudeai model · 1
- GLUTTONproduct · 1
- Myanmar governmentvictim · 1
- TONESHELLmalware · 1
- linuxFilemalware · 1
- DeepSeekai model · 1
- Alibabavendor · 1
- Mustang Pandathreat actor · 1
- Msagent.sysproduct · 1
- COOLCLIENTmalware · 1
- Kasperskyvendor · 1
- Myanmar IT sectorvictim · 1
- Indonesia Ministry of Foreign Affairsvictim · 1
- TONESHELLproduct · 1
- COOLCLIENTproduct · 1
- QUICAgentproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.