Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones.
The most unusual element of the report is evidence of Claude Code and DeepSeek-v4-pro operating together. Researchers concluded that Claude Code performed agentic tasks and preserved session context while DeepSeek handled reasoning, script refinement and selection of the next operational step. The findings do not implicate the model vendors themselves; they only demonstrate operator use of the products or interfaces.
Infrastructure cluster and TencShell
The investigation began with the known TencShell C2 cluster. Analysts searched for servers sharing an identical SHA-256 hash in HTTP headers on port 1111 and located 13 IP addresses across four autonomous systems. Several hosts also reused SSH host keys and TLS certificates, strengthening cluster linkage without proving single ownership.
One server at 112.213.124[.]132 exposed multiple services: port 1111 for HTTP delivery of malicious binaries, port 3000 running DeepAudit for source-code auditing, port 5003 running ARL for asset reconnaissance, port 8084 running Vshell C2, and port 8888 serving an open directory of operational data.
Attack chain and initial access
Operators employed several initial-access vectors rather than a single exploit. Reconnaissance scripts performed DNS brute force, certificate transparency lookups, adjacent IP discovery and HTTP fingerprinting. Priority targets included VPN gateways, GitLab, Jira, webmail and cloud services. More than 5,890 government hosts across ten countries were scanned and scored.
Documented compromises include SQL injection against a Taiwanese chemical company that yielded database contents and development-environment source code; exposure of Supabase anon keys and Azure Logic Apps SAS tokens at a Taiwanese telecom and edge-equipment manufacturer; and SQL injection via SQLMap against a Thai government administrative service that led to an administrative panel and a GIF-polyglot web shell.
In an Afghan Laravel 5.8.38 application, operators obtained source code, encryption keys, database credentials and mail-handling components, then built a Python script exploiting Laravel deserialization for remote code execution.
AI agent workflow
Logs revealed persistent Claude Code 2.1.165 sessions between 8 and 12 June 2026. The operator defined objectives and approved high-risk moves, Claude Code managed tools, shell commands, session state and parallel tasks, while DeepSeek-v4-pro performed analysis, bypass logic and script generation. The architecture reduces the cost of repetitive actions such as result aggregation, configuration review and context transfer between operator shifts.
A parallel disclosure by Anthropic described campaign GTG-1002, attributed with high confidence to a Chinese state group. Operators used prompt fragmentation and a cover story of authorized security testing to direct Claude Code, which performed 80–90 percent of tactical work while humans retained control over target selection and data exfiltration volume.
Defensive recommendations
Organizations should close public access to repositories, archives, backups and administrative interfaces; scan continuously for exposed secrets in client-side JavaScript; remediate SQL injection with parameterized queries; audit Laravel and other framework applications for outdated versions and unsafe deserialization; and detect web shells by MIME type and anomalous GET parameters rather than file extension alone.
Related articles
Chinese Cybercriminals Deploy AI Agents to Automate Exploitation of Exposed Windows and Linux Servers
A Chinese cybercriminal group tracked as UAT-10147 is actively using AI agents to automate reconnaissance, exploitation, and post-exploitation against internet-facing Windows and Linux servers. Cisco Talos identified the campaign after discovering approximately 170,000 URLs in the attackers' infrastructure, with targets spanning government, education, media, technology, and gaming organizations across multiple countries including Brazil. The group divides targets into smaller batches to accelerate scanning and exploitation of known vulnerabilities in applications such as Zimbra, AjaxPro, Nacos, and Telerik. AI agents go beyond simple code generation by producing exploitation guides, refining failed attacks, verifying payload success, and automating persistence and post-exploitation steps. In one observed case, the agents created scripts capable of validating permissions, exploiting ViewState deserialization, installing implants, and deploying web shells on compromised IIS servers. Cisco Talos assesses the operation as a shift toward semi-autonomous offensive orchestration rather than basic AI-assisted scripting.
Hermes Emerges as Modular Harness for Practical AI Security Testing
The article details the development of Hermes, a lightweight modular harness designed to turn raw language models into reliable AI security agents. Unlike heavy frameworks such as OpenClaw, Hermes uses dynamic skill loading, strict runbooks stored in Git, and a file-system source of truth to eliminate hallucinations and context bloat. It continuously scans dozens of sources including NVD, CISA KEV, arXiv and research blogs, then applies the custom TIPS scoring metric to rank threats before attempting reproduction. A dedicated Paper-to-PoC skill converts academic attack descriptions into executable code that is validated inside an isolated Ollama and Docker sandbox. Eight mandatory validation gates must pass before any finding is accepted, ensuring reproducibility and freshness of data. The system already supports tools such as Garak, PyRIT, promptfoo, fickling, modelscan and presidio, and evolves autonomously by committing successful attack scenarios back to its repository.
Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, CTO of Smart-Soft, explains why traditional IAM approaches fail to secure autonomous AI agents that dynamically select tools, change context, and delegate authority. Only 21.9% of teams treat agents as distinct identity-bearing entities, while 45.6% rely on shared API keys and 44.4% use generic tokens. Research from Gravitee, Cloud Security Alliance, and Aembit shows that 68% of organizations cannot distinguish AI agent actions from human actions, 74% grant excessive privileges, and 52% allow rights inheritance. The article maps NIST SP 800-207 Zero Trust principles—explicit verification, least privilege, and assume breach—to agent workloads using short-lived scoped tokens, SPIFFE/SPIRE credentials, and layered policy enforcement points. A concrete ticket-diagnosis scenario illustrates how prompt injection can be contained through per-task authorization, dedicated network segments, and independent telemetry from NGFW and SIEM. The piece concludes with an open question on sub-agent delegation chains and offers reference OPA/Rego policies plus runbooks for pilot implementations.
AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has introduced a new architecture designed to prevent compromised or manipulated AI agents from accessing data beyond user permissions. The approach relies on Amazon Bedrock AgentCore to shift authorization decisions from the agent itself to the underlying infrastructure and connected services. The core risk arises when agents receive broad credentials to query databases, repositories, and SaaS platforms, allowing potential prompt injection attacks to retrieve unauthorized information. In the proposed design, users authenticate via Amazon Cognito and receive JWT tokens containing attributes such as department or role. The AgentCore Runtime validates these tokens before executing any agent actions, rejecting requests that violate configured rules. For DynamoDB queries, temporary credentials are issued through AssumeRoleWithWebIdentity, with IAM policies enforcing strict access to authorized data partitions only.