Chinese Hackers Deploy AI Agents in Cyber Espionage Campaign
Automated attacks target governments, education, and industrial systems across Asia.
1Automated Cyber Espionage Framework
Hunt.io uncovered SecFlow, a Chinese cyber campaign using Claude, Qwen, and DeepSeek AI models to automate attacks. The framework coordinated reconnaissance, exploitation, and reporting across government and education targets. Operators switched between AI profiles without changing interfaces, routing requests through niestools.com proxies. The system automated vulnerability scanning, credential testing, exploit deployment, and data collection at scale.
2Major Government Breach
The most severe compromise penetrated Beijing's Fengtai District government systems. Attackers executed commands, dumped LSASS memory in 37 blocks to evade detection, and extracted SAM/SYSTEM registry hives containing password hashes. They created privileged backup accounts and exfiltrated 1.28GB of data including health records. The operation demonstrated complete attack lifecycle from initial web shell to persistent data theft across government networks.
3Education Sector Vulnerabilities
Ironically, hackers compromised a Chinese education AI platform through its own unsecured infrastructure. An unprotected backend exposed 23 AI agent configurations, 14 API secrets, and 104 chatbot logs containing student PII like IDs and academic records. Stolen credentials provided live API access, not just historical data. This breach highlights security gaps in educational technology deployments handling sensitive student information.
4Stealthy Attack Techniques
Operators used advanced evasion methods including steganographic PNG payloads via their GLUTTON framework. Executable code was hidden in image RGB channels, decoded server-side without writing malicious files. Java applications were tricked by fake MySQL servers triggering unsafe deserialization - flipping database connections into code execution. These techniques bypass traditional security controls checking file types or extensions.
5Operational Infrastructure
Researchers reconstructed the campaign through five accidentally exposed directories: AI orchestration host, Java exploitation workspace, fake MySQL service, Shellshock testing node, and payload distribution store. This rare visibility showed how specialized workers divided reconnaissance, exploitation, and reporting tasks. The infrastructure enabled switching AI models while maintaining operational consistency across targets.
6Data Exfiltration Methods
In the Fengtai breach, attackers systematically extracted 822 OA user records and 949 attachments. They used ASPX web shells not just for command execution but as operational backbones - querying internal databases and pulling memory dumps through authenticated SOCKS routes. Each 37-block LSASS dump was verified for correct byte counts before reconstruction, showing meticulous operational security.
7Broader Campaign Patterns
This marks the second recent incident where commercial AI tools were weaponized in state-linked intrusions, following June's Claude/DeepSeek campaign. The recurring pattern suggests growing adoption of AI automation by advanced persistent threats. Both campaigns demonstrate how AI can scale traditional hacking tasks while adding layers of operational flexibility and automation.
8Security Implications
The attacks reveal three critical vulnerabilities: unsecured AI infrastructure being exploited against its owners, legacy systems vulnerable to novel attack vectors like fake database services, and the risks of AI automation in malicious hands. As AI becomes embedded in defensive systems, its offensive potential grows proportionally - creating an escalating cybersecurity arms race with national security implications.
Original article: Security Affairs — Chinese Hackers Deploy AI Agents in Cyber Espionage Campaign