Hackers Exploit AI Models Claude, Qwen, DeepSeek for Cyberattacks

Key Takeaways

• A sophisticated cyberattack campaign leveraged commercial AI models like Claude, Qwen, and DeepSeek to automate and accelerate various stages of intrusion, from reconnaissance to data exfiltration.
• Targets included government entities and educational institutions in Taiwan, Indonesia, and mainland China, with a confirmed breach at a Fengtai District government environment exposing sensitive administrative and health records.
• The attackers utilized a custom framework named SecFlow to orchestrate AI agents, integrating them with conventional hacking tools such as webshells, stolen credentials, and bespoke remote-access malware like SecBox.
• The campaign highlights a significant evolution in attack methodology, demonstrating how AI can enhance the speed and coordination of cyber operations, underscoring the urgent need for robust patching, credential protection, and advanced behavioral detection.

Hackers Turn Claude, Qwen, and DeepSeek Into AI Agents for Cyberattacks

In a notable shift in cyberattack methodology, threat actors have integrated commercial artificial intelligence models, including Claude, Qwen, and DeepSeek, into their operational infrastructure to conduct targeted cyberattacks. This innovative campaign combined AI-driven tasking with established hacking techniques, such as exploiting vulnerable public-facing servers, deploying webshells, using stolen credentials, and custom remote-access malware.

The scope of this operation extended to high-value targets across Asia, impacting Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and various government and educational networks within mainland China. A specific breach within a Fengtai District government environment led to the exposure of administrative and health records, the collection of Windows credentials, and the deployment of malicious implants.

Analysts at Hunt.io said in a report that their investigation uncovered this activity by analyzing exposed attacker directories and tracking a shared SOCKS proxy across five interconnected workspaces. The researchers further identified linked infrastructure, reusable accounts, SecFlow files, and GLUTTON payload material, pointing to a coordinated and sophisticated operation.

These findings illustrate a practical evolution in how cyber intrusions can be managed. While AI did not introduce the underlying security vulnerabilities, its application significantly aided in task division, maintaining operational context, and accelerating coordinated actions. This development reinforces the critical importance of timely patching, comprehensive exposure management, robust credential protection, and diligent monitoring of unusual web server activity.

AI-Powered Orchestration with SecFlow

The attackers employed a framework dubbed SecFlow to break down overarching objectives into smaller, manageable tasks for specialized AI workers. This system allowed for the selection of Claude, Qwen, and DeepSeek profiles without altering the task interface, enabling the AI to handle various functions such as reconnaissance, exploit testing, data collection, and reporting across a unified workspace.

SecFlow facilitated the connection of these AI workers to target specifics, storage solutions, proxy routes, and tool permissions. The setup incorporated private model relays hosted under the niestools.com domain, alongside official provider routes. This architecture allowed subsequent AI agents to leverage the results of earlier tasks, rapidly escalating initial target engagement into coordinated malicious activity. Despite the advanced AI integration, the campaign largely relied on conventional intrusion tradecraft.

The AI agents utilized publicly available proof-of-concept code, performed credential testing, exploited vulnerable applications, deployed webshells, and installed a custom implant known as SecBox. This operational model bears similarities to previously reported China-linked campaigns that embedded commercial AI models within their intrusion frameworks. Interestingly, a claimed successful Apache Shiro exploitation was not substantiated by recovered evidence, yet it informed subsequent instructions, leading to over 27 unsuccessful GLUTTON follow-up tests. This highlights that while AI can amplify operational speed, it can also propagate initial errors throughout the entire workflow.

From Exposed Servers to Data Theft

The intrusion into the Fengtai District government commenced through an Office Automation application vulnerable to ASPX file uploads. Attackers exploited this weakness by deploying server-side command pages to execute Windows commands, map internal systems, attempt privilege escalation, extract LSASS memory and registry hives, query databases, and exfiltrate data via standard HTTP requests.

During this phase, the attackers also established a privileged application account and staged SecBox, a Go-based tool designed for remote access and network pivoting. SecBox provided capabilities for command execution, file transfer, port scanning, traffic proxying, and the use of alternative command-and-control routes. This combination of webshell access and endpoint tools underscores the necessity of monitoring web server attacks beyond initial exploit alerts.

In another incident, an exposed education AI management service inadvertently disclosed sensitive agent settings, secrets, conversations, and student profile data. Researchers confirmed that leaked credentials were used against a production API and an unauthenticated request was made to create an agent configuration. However, a full server takeover was not confirmed, a distinction crucial for accurate impact assessment.

The threat group also employed a deceptive MySQL service to target unsafe Java object processing, initiating an outbound database connection to deliver a Linux second-stage payload. Furthermore, they tested various vulnerabilities, including Shellshock, Spring4Shell, Ghostcat, Log4Shell, Grafana, Nexus, Nacos, and Shiro paths. This broad scanning activity is consistent with other AI-accelerated reconnaissance and credential attack campaigns.

What You Should Do

• Patch Promptly: Ensure all internet-facing software is patched immediately upon release of security updates.
• Manage Exposure: Regularly audit and remove exposed directories and restrict access to administrative interfaces.
• Protect Credentials: Implement strong credential protection measures, including multi-factor authentication, and rotate exposed credentials without delay.
• Monitor Web Servers: Scrutinize web servers for unusual activity, including the presence of unexpected ASPX, JSP, PHP, or image-based loaders.
• Behavioral Detection: Deploy behavior-based detection systems rather than relying solely on static signatures to identify evolving threats, especially those leveraging AI.
• Network Segmentation and Least Privilege: Implement network segmentation and enforce least-privilege access to limit potential damage in the event of a public application compromise.
• Incident Response Drills: Conduct regular incident response exercises to reduce containment times during actual breaches.
• Review Logs: Continuously review authentication and application logs for suspicious patterns.
• Validate Findings: Always validate automated security findings before taking action to avoid propagating errors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.