Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Networks

The activity is separate from an earlier campaign involving Chinese-speaking operators, but shows a similar pattern: commercial AI models were used as operational tools during real intrusions.

The actors targeted Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government systems in mainland China, and industrial organizations in Vietnam.

Researchers linked five exposed attacker workspaces by tracing a shared SOCKS proxy endpoint.

The infrastructure contained SecFlow, an AI orchestration framework that assigned reconnaissance, exploitation, data collection, and reporting tasks to specialized AI workers.

AI Agents Attack Governments

SecFlow allowed operators to switch between Claude, Qwen, and DeepSeek models without changing the task workflow. The agents received target details, proxy routes, tools, shared storage, and reporting instructions.

The AI models did not independently compromise systems. Instead, they helped organize and automate conventional offensive activity, including vulnerability scanning, credential testing, exploitation attempts, webshell deployment, evidence collection, and report generation.

The recovered environment included workflows for Shellshock, Spring4Shell, Ghostcat, Apache Shiro deserialization, Log4Shell, Grafana path traversal, Nexus path traversal, and a Nacos authentication bypass. Researchers observed eight CVEs in active attack workflows.

The campaign also used a webshell toolkit called GLUTTON. It supported Java, .NET, Node.js, JSP, ASPX, and PHP payloads.

Some payloads hid executable content inside PNG image files, helping attackers bypass simple file-extension or content-type checks.

However, the research showed that AI agents can also carry errors forward. In one case, an unsupported Apache Shiro exploitation claim was treated as successful by later workers.

More than 27 follow-up tests failed, but the system continued assigning webshell-related tasks based on the false result.

The most serious confirmed intrusion affected a Fengtai District government Office Automation environment in China.

The attackers gained Windows command execution through internet-facing web applications and used ASPX webshells to control compromised servers.

They collected an LSASS memory dump and SAM and SYSTEM registry hives, which can contain Windows credential material.

The group also accessed government Office Automation records, extracted 822 user-account entries, and created a new elevated application account for persistence.

Researchers said the attackers accessed government administrative files, health-related documents, and a chronic-disease report containing patient information. The affected environment stored 949 attachments totaling about 1.28 GB.

The attackers also deployed a Go-based remote-access implant named SecBox. The malware supported remote command execution, file transfers, SOCKS proxying, port forwarding, host discovery, and network pivoting.

It could receive replacement command-and-control routes through Pastebin, GitHub Gists, or temporary TryCloudflare domains, Hunt.io said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN

The post Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Networks appeared first on Cyber Security News.