Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones.
The most unusual element of the report is evidence of Claude Code and DeepSeek-v4-pro operating together. Researchers concluded that Claude Code performed agentic tasks and preserved session context while DeepSeek handled reasoning, script refinement and selection of the next operational step. The findings do not implicate the model vendors themselves; they only demonstrate operator use of the products or interfaces.
Infrastructure cluster and TencShell
The investigation began with the known TencShell C2 cluster. Analysts searched for servers sharing an identical SHA-256 hash in HTTP headers on port 1111 and located 13 IP addresses across four autonomous systems. Several hosts also reused SSH host keys and TLS certificates, strengthening cluster linkage without proving single ownership.
One server at 112.213.124[.]132 exposed multiple services: port 1111 for HTTP delivery of malicious binaries, port 3000 running DeepAudit for source-code auditing, port 5003 running ARL for asset reconnaissance, port 8084 running Vshell C2, and port 8888 serving an open directory of operational data.
Attack chain and initial access
Operators employed several initial-access vectors rather than a single exploit. Reconnaissance scripts performed DNS brute force, certificate transparency lookups, adjacent IP discovery and HTTP fingerprinting. Priority targets included VPN gateways, GitLab, Jira, webmail and cloud services. More than 5,890 government hosts across ten countries were scanned and scored.
Documented compromises include SQL injection against a Taiwanese chemical company that yielded database contents and development-environment source code; exposure of Supabase anon keys and Azure Logic Apps SAS tokens at a Taiwanese telecom and edge-equipment manufacturer; and SQL injection via SQLMap against a Thai government administrative service that led to an administrative panel and a GIF-polyglot web shell.
In an Afghan Laravel 5.8.38 application, operators obtained source code, encryption keys, database credentials and mail-handling components, then built a Python script exploiting Laravel deserialization for remote code execution.
AI agent workflow
Logs revealed persistent Claude Code 2.1.165 sessions between 8 and 12 June 2026. The operator defined objectives and approved high-risk moves, Claude Code managed tools, shell commands, session state and parallel tasks, while DeepSeek-v4-pro performed analysis, bypass logic and script generation. The architecture reduces the cost of repetitive actions such as result aggregation, configuration review and context transfer between operator shifts.
A parallel disclosure by Anthropic described campaign GTG-1002, attributed with high confidence to a Chinese state group. Operators used prompt fragmentation and a cover story of authorized security testing to direct Claude Code, which performed 80–90 percent of tactical work while humans retained control over target selection and data exfiltration volume.
Defensive recommendations
Organizations should close public access to repositories, archives, backups and administrative interfaces; scan continuously for exposed secrets in client-side JavaScript; remediate SQL injection with parameterized queries; audit Laravel and other framework applications for outdated versions and unsafe deserialization; and detect web shells by MIME type and anomalous GET parameters rather than file extension alone.
Related articles
Microsoft Copilot Abused to Accelerate Corporate Account Takeovers and Bank Transfer Frauds
Cybercriminals can leverage Microsoft Copilot to speed up the compromise of corporate accounts and execute financial frauds. In a controlled simulation, researchers demonstrated how the AI assistant helped redirect a $247,500 bank transfer after gaining access to an employee's email. The attack begins with the creation of inbox rules that automatically delete suspicious login alerts, followed by rapid analysis of internal communications to identify high-value targets. Copilot was then used to replicate the victim's writing style and craft a convincing phishing email capable of stealing session tokens and bypassing multi-factor authentication. Once the executive account was taken over, the tool quickly located pending payments and generated a fraudulent request to alter the recipient bank details. The scenario highlights risks from legitimate AI features rather than any specific vulnerability in Copilot itself.
Vibe Hacking Rises: Generative AI Lowers Barriers for Offensive Security Operations
Generative AI is reshaping the cybersecurity threat landscape by dramatically reducing the cost of offensive security knowledge. Previously, attackers needed years of experience in reverse engineering and exploit development to conduct meaningful intrusions, but AI now assists with research, code generation, debugging, and adapting known techniques to new environments. This enables less experienced individuals to build functional attack chains in weeks rather than years. The article introduces the concept of vibe hacking, where attackers collaborate with AI assistants using natural language prompts in a process similar to vibe coding. Defenders can no longer rely on the scarcity of skilled adversaries and must shift toward continuous validation frameworks such as CTEM, AEV, and PTaaS. Senior human experts remain essential for risk judgment and business context, even as automation accelerates routine tasks.
OWASP LLM10 Unbounded Consumption: Testing YandexGPT Lite 5 and GigaChat Lite on Resource-Intensive Prompts
The article examines OWASP LLM10: Unbounded Consumption, a category focused on attacks that force large language models to perform computationally expensive tasks without traditional denial-of-service traffic. Researchers used the AI Red Team platform to evaluate two flagship Russian models, YandexGPT Lite 5 and GigaChat Lite, against prompts designed to trigger recursive context expansion, fractal nesting, combinatorial explosions, and multi-agent simulations. The study highlights how a single carefully crafted prompt can generate disproportionate token consumption, GPU load, and API costs compared with conventional DoS methods. Both models demonstrated defensive strategies including hard generation limits at 512 tokens, graceful degradation by summarizing instead of expanding, and early refusal with alternative suggestions. The work was supported by the Foundation for Assistance to Innovations and aims to improve architectural protections for LLM applications. Examples of tested prompts and observed model behaviors are provided for research and educational purposes only.
DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes
Researchers from Unit 42 at Palo Alto Networks recovered the full activity log of an autonomous AI agent built with the Hermes Agent framework and the DeepSeek model. The agent scanned the internet for targets, downloaded public exploits, evaluated vulnerabilities such as CVE-2026-33017 in Langflow and a pair of flaws in n8n, and attempted exploitation without any human intervention. Despite processing hundreds of hosts, the autonomous loop failed to compromise a single system because required configurations were absent on the victim servers. Parallel manual operations conducted by the same actor using traditional tools succeeded against three Citrix NetScaler instances and eleven Marimo deployments. The operator, assessed to be based in Zhuhai, China, relied on Telegram as the command channel and lost operational security when the agent exposed its home directory containing logs and API keys. The case demonstrates both the current limitations of LLM-driven attack agents and the low barrier to entry created by open-source agent frameworks paired with permissive models.