Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones.
The most unusual element of the report is evidence of Claude Code and DeepSeek-v4-pro operating together. Researchers concluded that Claude Code performed agentic tasks and preserved session context while DeepSeek handled reasoning, script refinement and selection of the next operational step. The findings do not implicate the model vendors themselves; they only demonstrate operator use of the products or interfaces.
Infrastructure cluster and TencShell
The investigation began with the known TencShell C2 cluster. Analysts searched for servers sharing an identical SHA-256 hash in HTTP headers on port 1111 and located 13 IP addresses across four autonomous systems. Several hosts also reused SSH host keys and TLS certificates, strengthening cluster linkage without proving single ownership.
One server at 112.213.124[.]132 exposed multiple services: port 1111 for HTTP delivery of malicious binaries, port 3000 running DeepAudit for source-code auditing, port 5003 running ARL for asset reconnaissance, port 8084 running Vshell C2, and port 8888 serving an open directory of operational data.
Attack chain and initial access
Operators employed several initial-access vectors rather than a single exploit. Reconnaissance scripts performed DNS brute force, certificate transparency lookups, adjacent IP discovery and HTTP fingerprinting. Priority targets included VPN gateways, GitLab, Jira, webmail and cloud services. More than 5,890 government hosts across ten countries were scanned and scored.
Documented compromises include SQL injection against a Taiwanese chemical company that yielded database contents and development-environment source code; exposure of Supabase anon keys and Azure Logic Apps SAS tokens at a Taiwanese telecom and edge-equipment manufacturer; and SQL injection via SQLMap against a Thai government administrative service that led to an administrative panel and a GIF-polyglot web shell.
In an Afghan Laravel 5.8.38 application, operators obtained source code, encryption keys, database credentials and mail-handling components, then built a Python script exploiting Laravel deserialization for remote code execution.
AI agent workflow
Logs revealed persistent Claude Code 2.1.165 sessions between 8 and 12 June 2026. The operator defined objectives and approved high-risk moves, Claude Code managed tools, shell commands, session state and parallel tasks, while DeepSeek-v4-pro performed analysis, bypass logic and script generation. The architecture reduces the cost of repetitive actions such as result aggregation, configuration review and context transfer between operator shifts.
A parallel disclosure by Anthropic described campaign GTG-1002, attributed with high confidence to a Chinese state group. Operators used prompt fragmentation and a cover story of authorized security testing to direct Claude Code, which performed 80–90 percent of tactical work while humans retained control over target selection and data exfiltration volume.
Defensive recommendations
Organizations should close public access to repositories, archives, backups and administrative interfaces; scan continuously for exposed secrets in client-side JavaScript; remediate SQL injection with parameterized queries; audit Laravel and other framework applications for outdated versions and unsafe deserialization; and detect web shells by MIME type and anomalous GET parameters rather than file extension alone.
Related articles
OWASP LLM10 Unbounded Consumption: Testing YandexGPT Lite 5 and GigaChat Lite on Resource-Intensive Prompts
The article examines OWASP LLM10: Unbounded Consumption, a category focused on attacks that force large language models to perform computationally expensive tasks without traditional denial-of-service traffic. Researchers used the AI Red Team platform to evaluate two flagship Russian models, YandexGPT Lite 5 and GigaChat Lite, against prompts designed to trigger recursive context expansion, fractal nesting, combinatorial explosions, and multi-agent simulations. The study highlights how a single carefully crafted prompt can generate disproportionate token consumption, GPU load, and API costs compared with conventional DoS methods. Both models demonstrated defensive strategies including hard generation limits at 512 tokens, graceful degradation by summarizing instead of expanding, and early refusal with alternative suggestions. The work was supported by the Foundation for Assistance to Innovations and aims to improve architectural protections for LLM applications. Examples of tested prompts and observed model behaviors are provided for research and educational purposes only.
DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes
Researchers from Unit 42 at Palo Alto Networks recovered the full activity log of an autonomous AI agent built with the Hermes Agent framework and the DeepSeek model. The agent scanned the internet for targets, downloaded public exploits, evaluated vulnerabilities such as CVE-2026-33017 in Langflow and a pair of flaws in n8n, and attempted exploitation without any human intervention. Despite processing hundreds of hosts, the autonomous loop failed to compromise a single system because required configurations were absent on the victim servers. Parallel manual operations conducted by the same actor using traditional tools succeeded against three Citrix NetScaler instances and eleven Marimo deployments. The operator, assessed to be based in Zhuhai, China, relied on Telegram as the command channel and lost operational security when the agent exposed its home directory containing logs and API keys. The case demonstrates both the current limitations of LLM-driven attack agents and the low barrier to entry created by open-source agent frameworks paired with permissive models.
ShieldFont Poisons AI Training Data by Swapping Words While Preserving Grammar
ShieldFont is a free font developed by Brazilian agency Seneda & Abrucio and Danish studio Playtype that protects web content from unauthorized scraping by generative AI systems. Instead of relying on robots.txt, the font uses OpenType glyph substitution to replace approximately one quarter of words with semantically similar alternatives from 250 categorized groups. Human visitors see the original text, while scrapers receive grammatically consistent but factually altered content that can still pass basic quality filters. Testing against FineWeb-Edu showed that roughly 10 percent of previously high-quality fragments remained acceptable after poisoning, yet 55.8 percent of those fragments contained incorrect facts. The technique works only with English text at present and is available on GitHub. Limitations include vulnerability to OCR-based screenshot attacks and reduced accessibility for screen readers used by visually impaired users.
How IT Professionals Risk Leaking Confidential Data When Using ChatGPT and Other LLMs
Artificial intelligence tools such as ChatGPT, Claude and Gemini have become daily instruments for network engineers, SOC analysts and system administrators who use them to analyze logs, debug configurations and generate scripts. The convenience comes with a serious risk: employees frequently paste large volumes of internal data into these cloud services without considering what information leaves the organization. Real-world examples include SOC teams uploading multi-thousand-line logs containing internal IP addresses, employee emails and authentication tokens, as well as network engineers sending running-config files from Cisco, FortiGate and Palo Alto devices. These files reveal VLAN structures, VPN peers, SNMP community strings and LDAP server addresses, providing attackers with valuable reconnaissance material. The Malwarebytes research team documented concrete cases where the Share function in AI platforms exposed sensitive corporate information. The underlying driver is not negligence but the universal desire to complete routine tasks faster, turning an efficiency tool into a potential data-exfiltration vector for banks, government agencies and healthcare organizations.