Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.
- SecFlow coordinated recon, exploitation and reporting via Claude, Qwen, DeepSeek
- Fengtai government breach: 822 accounts, 949 attachments, 1.28GB stolen
- LSASS dump exfiltrated in 37 chunks over authenticated SOCKS route
- GLUTTON webshell steganographically hides payloads in PNG color channels
- Fake MySQL service triggers Java deserialization for initial access
- ATT&CK
- T1505.003 Web ShellT1003.001 LSASS MemoryT1003.002 Security Account ManagerT1027.003 SteganographyT1203 Exploitation for Client Execution
- Threat actors
- China-nexus threat actor
- Malware
- GLUTTON
- Organizations
- Hunt.ioKuomintang
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | niestools.com | routed requests through private proxy servers linked to the niestools.com domain. The AI models did not break into systems on their o |
From the original article
4 min read at securityaffairs.com
Hunt. io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets. Threat intelligence firm Hunt.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.