Chinese Cyber Espionage Campaign Utilizes AI Tools for Intrusions
In June 2026, Hunt.io researchers discovered an active cyber intrusion campaign linked to Chinese actors while investigating known TencShell command-and-control infrastructure. Their investigation led them to 13 servers based in Hong Kong, where they found an open directory containing 2,431 files and 80 subdirectories, including victim source code, custom exploit scripts, and operator logs written in Simplified Chinese. This breach revealed a significant operational oversight by the attackers, allowing researchers to access sensitive materials.
The campaign is notable not only for its extensive targeting but also for the advanced tools employed. According to Hunt.io, the AI tools Claude Code and DeepSeek-v4-pro were integral to the operation, facilitating the automation of large-scale intrusions. Claude Code managed execution tasks, while DeepSeek-v4-pro handled planning and decision-making, showcasing a sophisticated use of artificial intelligence in cyber operations.
Logs recovered from the servers indicated that the attackers divided responsibilities between the two AI models. Claude Code executed Bash commands and managed long-running sessions, while DeepSeek-v4-pro generated scripts and identified new attack techniques. This dual-model approach allowed for a more efficient and adaptive attack strategy.
The logs also revealed that the same infrastructure was used for various country-specific campaigns, with timestamps indicating active maintenance as recently as June 18-19, 2026. In Thailand, attackers exploited a government administrative system through SQL injection, gaining access to sensitive employee data. In Afghanistan, a government web application was compromised, leading to the extraction of source code and database credentials.
In Taiwan, the attackers targeted eight organizations in the supply chain and defense sectors, successfully exploiting two. They employed SQL injection techniques and exploited hardcoded credentials found in publicly accessible files, gaining access to cloud infrastructure accounts. The reconnaissance efforts included DNS brute-forcing and HTTP service fingerprinting, focusing on vulnerabilities in VPN gateways and other critical systems.
While the United States was not confirmed as a target, network scanning logs indicated potential interest in NASA infrastructure. Cloned phishing pages impersonating local government entities were also found, suggesting a broader strategy to capture citizen data.
In addition to government targets, the campaign extended to financial services firms across Europe, Australia, and Asia. A CORS exploit page successfully extracted WordPress administrator credentials from a payment processing platform, with cross-referencing confirming the identities of the exposed accounts.
The infrastructure used by the attackers consisted of 13 servers across four hosting providers in Hong Kong. Some servers shared SSH host key fingerprints and ran identical reconnaissance software, indicating a coordinated effort. The malware recovered from the servers was a previously unreported Linux/ARM binary capable of extracting sensitive messaging credentials and cloud service access keys.
The campaign reflects an intermediate-to-advanced capability set, characterized by custom exploit development and the integration of AI for real-time attack assistance. Indicators such as the use of Simplified Chinese and the clustering of infrastructure in Hong Kong align with known activities of China-based threat actors. Hunt.io notified affected organizations and national CERTs on July 6, 2026, providing a comprehensive report on the indicators of compromise and the operational details of the campaign.
