Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones.
The most unusual element of the report is evidence of Claude Code and DeepSeek-v4-pro operating together. Researchers concluded that Claude Code performed agentic tasks and preserved session context while DeepSeek handled reasoning, script refinement and selection of the next operational step. The findings do not implicate the model vendors themselves; they only demonstrate operator use of the products or interfaces.
Infrastructure cluster and TencShell
The investigation began with the known TencShell C2 cluster. Analysts searched for servers sharing an identical SHA-256 hash in HTTP headers on port 1111 and located 13 IP addresses across four autonomous systems. Several hosts also reused SSH host keys and TLS certificates, strengthening cluster linkage without proving single ownership.
One server at 112.213.124[.]132 exposed multiple services: port 1111 for HTTP delivery of malicious binaries, port 3000 running DeepAudit for source-code auditing, port 5003 running ARL for asset reconnaissance, port 8084 running Vshell C2, and port 8888 serving an open directory of operational data.
Attack chain and initial access
Operators employed several initial-access vectors rather than a single exploit. Reconnaissance scripts performed DNS brute force, certificate transparency lookups, adjacent IP discovery and HTTP fingerprinting. Priority targets included VPN gateways, GitLab, Jira, webmail and cloud services. More than 5,890 government hosts across ten countries were scanned and scored.
Documented compromises include SQL injection against a Taiwanese chemical company that yielded database contents and development-environment source code; exposure of Supabase anon keys and Azure Logic Apps SAS tokens at a Taiwanese telecom and edge-equipment manufacturer; and SQL injection via SQLMap against a Thai government administrative service that led to an administrative panel and a GIF-polyglot web shell.
In an Afghan Laravel 5.8.38 application, operators obtained source code, encryption keys, database credentials and mail-handling components, then built a Python script exploiting Laravel deserialization for remote code execution.
AI agent workflow
Logs revealed persistent Claude Code 2.1.165 sessions between 8 and 12 June 2026. The operator defined objectives and approved high-risk moves, Claude Code managed tools, shell commands, session state and parallel tasks, while DeepSeek-v4-pro performed analysis, bypass logic and script generation. The architecture reduces the cost of repetitive actions such as result aggregation, configuration review and context transfer between operator shifts.
A parallel disclosure by Anthropic described campaign GTG-1002, attributed with high confidence to a Chinese state group. Operators used prompt fragmentation and a cover story of authorized security testing to direct Claude Code, which performed 80–90 percent of tactical work while humans retained control over target selection and data exfiltration volume.
Defensive recommendations
Organizations should close public access to repositories, archives, backups and administrative interfaces; scan continuously for exposed secrets in client-side JavaScript; remediate SQL injection with parameterized queries; audit Laravel and other framework applications for outdated versions and unsafe deserialization; and detect web shells by MIME type and anomalous GET parameters rather than file extension alone.
Related articles
Deepfakes Turn Job Interviews into Cyberattack Vectors Targeting IT Candidates and Recruiters
Deepfake technology and malicious test assignments are increasingly used during IT hiring processes to conduct industrial espionage or deploy malware. Attackers impersonate recruiters or candidates, sending infected GitHub repositories or npm packages that install backdoors stealing credentials and enabling remote access. Groups such as Lazarus and the dedicated Contagious Interview collective have run campaigns against chemical and IT firms, while individual cases like the Smello Python developer incident show how prepare scripts in package.json can trigger hidden payloads. Gartner predicts that by 2028 one in four job applicants could be fake, creating risks beyond bad hires including data theft and financial loss. Defenses include isolated virtual machines for test tasks, profile verification by companies like Socure, and interview techniques such as the GOTCHA movement challenges or corneal reflection probes developed by universities. Major firms including Cisco, McKinsey, and Google are returning to in-person interviews as a reliable countermeasure. The rapid evolution of deepfake quality tracked by Unit 42 means layered verification combining technical, procedural, and human checks is now essential.
Agent-Ops 0.4.0 Released: Methodology for Secure Human-AI Collaboration in IT Operations
Sergey Zhitinsky, founder of Git in Sky, has published the public normative candidate for Agent-Ops 0.4.0, an open industry methodology governing how engineers and AI agents jointly handle IT infrastructure tasks. The framework keeps humans firmly in the decision-making loop while using deterministic programs for data collection and approved changes. It addresses risks such as prompt injection through processed data, unverified model outputs, and unclear accountability when AI recommendations lead to incidents. The methodology divides work across eight explicit steps and three separate planes: data, governance, and independent verification performed by a Guardian role. Two additional companies have joined as maintainers following agreements at the IT Elements 2026 conference, turning the project into a multi-organization effort. Contributors are invited to help refine contracts, schemas, and operational scenarios through GitHub and GitVerse.
ProxyKey MCP: Securing API Access for AI Agents Without Exposing Credentials
ProxyKey has released an MCP server that allows AI coding agents such as Claude Code and Cursor to manage API credentials without ever reading the actual secret values. The solution addresses the risk that any key visible to an agent becomes compromised through logging, tracing, or prompt injection. Real provider keys are stored encrypted with AES-256-GCM and never returned by any API endpoint after initial entry. Agents instead receive limited virtual passes that support IP binding, rate limits, TTL, and detailed request logging. A pending-secret workflow lets agents prepare services before the real token exists, with the human entering the secret only through a web panel. The approach deliberately restricts the MCP tool contract so no operation can read or return secret values.
Shadow AI in CI/CD: Why AI Agents Must Be Modeled as Security Threats
A new analysis from the CNCF highlights the growing risks of Shadow AI within continuous integration and continuous deployment pipelines. The report argues that AI agents should be treated as potential threats rather than simple productivity tools. Starting from a developer's laptop and extending to Kubernetes clusters, these agents can introduce unauthorized access paths and data exposure risks. Security teams are urged to incorporate AI agent behavior into formal threat modeling exercises. The discussion emphasizes the need for visibility and control over autonomous AI components operating in production environments.