Hunt.io Discovers Chinese Cyber Espionage Campaign Using Claude Code and DeepSeek AI to Automate Attacks on Government Systems Across Four Countries

Hunt.io researchers reported that a pivot from known TencShell command-and-control infrastructure led them in June 2026 to an open directory on a Hong Kong-based server containing 2,431 files and 80 subdirectories, including victim source code, exploit scripts, and operator logs written in Simplified Chinese 12. Hunt.io assessed that Claude Code handled execution, including bash commands and phishing-page construction, while DeepSeek-v4-pro drove attack reasoning and exploit revisions, with operator sessions dated June 8 through 12, 2026 12. The researchers documented active exploitation of government systems in Thailand, where SQL injection gave attackers admin access and exposed employee national ID data, and in Afghanistan, where a citizen complaint portal built on Laravel was breached for source code and credentials 12. In Taiwan, Hunt.io identified reconnaissance against eight organizations with two, a chemical manufacturer and a telecom and edge-device maker, successfully exploited, while a parallel campaign extracted WordPress administrator credentials from a payment processing platform serving Europe, Australia, and Asia 1. A fourth country, the United States, saw reconnaissance-only activity with cloned phishing pages built for the D.C. Council and Delaware County government sites, part of broader scanning that touched more than 5,890 government hosts across 10 countries. Hunt.io traced the infrastructure to 13 Hong Kong servers across four hosting providers, identified an undocumented C2 framework it named Gshell, and notified affected organizations and national CERTs on July 6 ahead of publication 123.