Cyber — 2026-09-05

Chinese Hackers Deploy AI Agents Including Claude and DeepSeek in Multi-Country Espionage Campaign

BLUFSecFlow's proxy architecture renders AI-provider abuse controls irrelevant, forcing defenders to detect tradecraft behaviors rather than model usage as Chinese operators industrialize AI-augmented espionage.

Threat intelligence firm Hunt.io reported on September 3 that a Chinese-speaking operator embedded Claude, Qwen, and DeepSeek AI models into a live cyberespionage campaign via a framework called SecFlow, which routed requests through private proxy servers tied to the niestools.com domain rather than official APIs 1. Hunt.io reconstructed the operation from five accidentally exposed open directories, identifying targets including Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam 12. The most extensive confirmed breach hit a Fengtai District government office automation environment, where operators executed Windows commands, split an LSASS memory dump into 37 chunks, extracted SAM and SYSTEM registry hives, pulled 822 user account records, and exfiltrated 949 attachments totaling 1.28GB, including a chronic-disease report with real patient health information 13. A separate incident exposed a Chinese education AI platform's backend, revealing 23 agent configurations, 14 API secret fields, and 104 chatbot conversations containing student data, while a third breach gave operators root database access to a university campus-card system through a fake MySQL deserialization service 23. This is the second such campaign Hunt.io has identified in two months, following a July disclosure involving Claude Code and DeepSeek against targets in Afghanistan and Thailand 13.

Analysis
Model attribution offers defenders no purchase here: SecFlow's proxy layer at niestools.com strips provider-side telemetry, leaving Anthropic, Alibaba, and DeepSeek unable to flag traffic through their own abuse-monitoring systems, since operators use the models as interchangeable executors of conventional tradecraft rather than autonomous actors. Detection must shift toward behavioral indicators, such as chunked LSASS extraction and steganographic payloads, rather than model-specific signatures. Recurrence within two months of the July Afghanistan-Thailand campaign suggests operator tradecraft is maturing rather than a one-off, though sourcing rests entirely on Hunt.io's single technical account, with other outlets merely repeating it, and visibility depended on operators' accidental exposure, meaning better-secured campaigns leave no trace. The AI framing may instead be largely commercial branding of routine intrusion techniques, such as webshells and deserialization exploits, that would function identically without any AI component, counseling skepticism toward vendor-driven AI-threat narratives absent independent corroboration.

4 sources

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia - Hunt.io
Chinese Hackers Deploy AI Agents in Multi-Country Campaign - CyberMaterial
Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign - Security Affairs
Chinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Systems - GBHackers