Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek

In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones.

The most unusual element of the report is evidence of Claude Code and DeepSeek-v4-pro operating together. Researchers concluded that Claude Code performed agentic tasks and preserved session context while DeepSeek handled reasoning, script refinement and selection of the next operational step. The findings do not implicate the model vendors themselves; they only demonstrate operator use of the products or interfaces.

Infrastructure cluster and TencShell

The investigation began with the known TencShell C2 cluster. Analysts searched for servers sharing an identical SHA-256 hash in HTTP headers on port 1111 and located 13 IP addresses across four autonomous systems. Several hosts also reused SSH host keys and TLS certificates, strengthening cluster linkage without proving single ownership.

One server at 112.213.124[.]132 exposed multiple services: port 1111 for HTTP delivery of malicious binaries, port 3000 running DeepAudit for source-code auditing, port 5003 running ARL for asset reconnaissance, port 8084 running Vshell C2, and port 8888 serving an open directory of operational data.

Attack chain and initial access

Operators employed several initial-access vectors rather than a single exploit. Reconnaissance scripts performed DNS brute force, certificate transparency lookups, adjacent IP discovery and HTTP fingerprinting. Priority targets included VPN gateways, GitLab, Jira, webmail and cloud services. More than 5,890 government hosts across ten countries were scanned and scored.

Documented compromises include SQL injection against a Taiwanese chemical company that yielded database contents and development-environment source code; exposure of Supabase anon keys and Azure Logic Apps SAS tokens at a Taiwanese telecom and edge-equipment manufacturer; and SQL injection via SQLMap against a Thai government administrative service that led to an administrative panel and a GIF-polyglot web shell.

In an Afghan Laravel 5.8.38 application, operators obtained source code, encryption keys, database credentials and mail-handling components, then built a Python script exploiting Laravel deserialization for remote code execution.

AI agent workflow

Logs revealed persistent Claude Code 2.1.165 sessions between 8 and 12 June 2026. The operator defined objectives and approved high-risk moves, Claude Code managed tools, shell commands, session state and parallel tasks, while DeepSeek-v4-pro performed analysis, bypass logic and script generation. The architecture reduces the cost of repetitive actions such as result aggregation, configuration review and context transfer between operator shifts.

A parallel disclosure by Anthropic described campaign GTG-1002, attributed with high confidence to a Chinese state group. Operators used prompt fragmentation and a cover story of authorized security testing to direct Claude Code, which performed 80–90 percent of tactical work while humans retained control over target selection and data exfiltration volume.

Defensive recommendations

Organizations should close public access to repositories, archives, backups and administrative interfaces; scan continuously for exposed secrets in client-side JavaScript; remediate SQL injection with parameterized queries; audit Laravel and other framework applications for outdated versions and unsafe deserialization; and detect web shells by MIME type and anomalous GET parameters rather than file extension alone.