Chinese-Speaking Operator Uses SecFlow AI Agents in Multi-Country Cyber Campaign

Google News surfaced a new investigation showing a Chinese-speaking operator using AI agents across six countries and nearly a dozen sectors. The campaign connected Claude, Qwen, and DeepSeek to a framework called SecFlow. It coordinated reconnaissance, exploitation, data collection, and reporting while conventional hacking tools performed the actual intrusions.

Researchers at Hunt.io reconstructed the operation through five exposed server directories. The evidence links government, education, political, healthcare, industrial, and consular targets across Asia. Confirmed compromises included a Beijing district government environment, a Chinese education platform, and a university campus-card system.

The central conflict is not artificial intelligence replacing a skilled hacker. It is AI becoming an orchestration layer that lets one operator run more tasks, retain findings, and reuse attack procedures. However, the same shared context also preserved a false result and sent more than 27 follow-up tasks in the wrong direction.

The Exposed Servers Revealed One Connected Campaign

Five poorly secured workspaces gave researchers an unusually detailed view of an AI-assisted intrusion operation.

Hunt.io began its investigation with an exposed directory at an internet-facing server. The company captured that directory on July 24, 2026. A hardcoded SOCKS proxy address inside a payload gave researchers a pivot into the wider infrastructure.

A SOCKS proxy relays network traffic through another server, which can obscure the operator’s original location. Searching for that shared endpoint produced 120 file-content matches across five indexed hosts. Common accounts, SecFlow files, GLUTTON artifacts, and payload links connected the hosts.

The five servers had different operational roles. One stored the AI orchestration environment. Another held Java and authentication-system exploitation tools. A third ran a fake MySQL service designed to deliver malicious Java objects.

The remaining systems supported credential testing, Shellshock attacks, payload distribution, command-and-control traffic, and post-compromise activity. The infrastructure appeared in Hunt.io captures between May 15 and August 4, 2026.

According to the full SecFlow investigation, the combined workspaces touched six countries and nearly a dozen sectors. The identified targets included government and political organizations in Taiwan, an Indonesian ministry, Chinese government systems, educational platforms, and Vietnamese industrial hosts.

The strongest evidence concerned a Fengtai District government Office Automation environment in Beijing. Office Automation software supports internal administrative work, document handling, and staff workflows. Hunt.io says the operator progressed from a public application to Windows command execution and internal network discovery.

The retained material showed credential theft, database access, attempted lateral movement, file collection, and deployment of a remote implant. Lateral movement means using one compromised system to reach additional machines or services inside the same organization.

The operator reportedly collected an LSASS memory dump and Windows registry hives. LSASS is a Windows process that manages authentication material, making its memory a frequent credential-theft target. The records also showed the extraction of 822 user accounts from the government environment.

A separate compromise affected the management layer of a Chinese education AI platform. The exposed backend returned 23 AI-agent configurations and 14 populated secret fields. It also revealed internal service addresses and 104 complete dialogue records.

Hunt.io found 169 retained conversations containing 339 messages or queries. Those conversations involved assistants for education, job recommendations, résumés, and topic selection. The exposed credentials reportedly included application keys and other production access material.

The researchers also found root database access and Grafana administrator access in a university campus-card environment. Root access grants the highest database privileges. Grafana is a monitoring and visualization platform that can expose operational data when an administrator account is compromised.

These findings distinguish the campaign from an unverified collection of scanner logs. Some targets only appeared in plans or attempted workflows, but several systems showed evidence of actual access. The open workspaces retained commands, responses, data samples, credentials, and deployed files.

That distinction matters when reading a Google News headline that uses the broad term “Chinese hackers.” Hunt.io identified a Chinese-speaking operator and a recurring handle, Nie. Its public report did not attribute the entire operation to a Chinese government agency.

Language, usernames, domestic infrastructure, and target selection can support an attribution assessment. They do not automatically establish state sponsorship. The evidence supports describing a Chinese-speaking threat operator, while stronger political attribution remains unproven.

SecFlow Turned AI Models Into Swappable Workers

The important change was orchestration, not a newly invented exploit or autonomous super-hacker.

SecFlow converted short objectives into assignments for specialized workers. Those workers shared files, target configurations, session state, network routes, evidence, and reporting instructions. One task could discover an endpoint, while later tasks tested credentials or prepared an exploit.

The system divided work across reconnaissance, exploitation, collection, and reporting roles. Reconnaissance gathers information about a target before or during an intrusion. Collection organizes information taken from systems that the operator has reached.

SecFlow could switch among Claude, Qwen, and DeepSeek profiles without changing its task interface. That design treated the underlying language model as a replaceable reasoning component. The framework, files, tools, and operating instructions provided continuity.

This separation is significant. An operator does not need one model to excel at every stage. Different models can process an objective, write code, interpret output, summarize evidence, or propose a new path.

The workspaces indicate that SecFlow connected AI workers to a shared filesystem and conventional security tools. It also routed target-facing traffic through authenticated proxies. Private endpoints under the niestools.com domain reportedly handled some model traffic.

A Sub2API gateway appeared on associated infrastructure. Sub2API is an open-source system that pools upstream AI subscriptions or API keys behind one interface. Such gateways have legitimate uses, including authentication and load balancing, but they can also make account sharing harder to trace.

The agents did not replace the attack stack. They organized it. Hunt.io found public proof-of-concept code, leaked credentials, webshells, custom implants, network scanners, and exploitation scripts throughout the workspaces.

A webshell is a malicious server-side file that accepts remote commands through web requests. The Fengtai compromise relied heavily on ASP and ASPX webshells. Those files enabled command execution, database queries, credential collection, file transfer, and malware deployment.

The operator also used a Go-based implant called SecBox. Hunt.io described it as a private or customized remote-access and network-pivot framework. Its capabilities included remote shell access, file transfer, process control, port scanning, proxying, and network forwarding.

SecBox could communicate over TCP, TLS, WebSocket, KCP, or QUIC connections. It also supported dead drop resolvers, a technique that retrieves updated command-and-control addresses from public services. Replacing an address through a remote post can keep an implant reachable without rebuilding it.

The campaign used eight named vulnerabilities in active workflows. They included Shellshock, Spring4Shell, Ghostcat, Log4Shell, Apache Shiro deserialization, Grafana path traversal, Nexus path traversal, and a Nacos authentication bypass.

Several of those vulnerabilities are years old. Shellshock dates to 2014, while Log4Shell became public in 2021. Their continued value shows that AI-enabled attackers do not require unknown vulnerabilities when exposed systems remain unpatched or misconfigured.

SecFlow therefore changed operational tempo more than technical novelty. It kept notes, assigned parallel tasks, and converted findings into later actions. The operator could preserve a procedure and direct another worker to repeat it against a different environment.

That workflow resembles how legitimate engineering agents coordinate research, implementation, testing, and documentation. In an offensive setting, the same pattern links scanning, exploitation, credential use, persistence, and reporting.

This is why the story extends beyond another cybersecurity item in Google News. AI models are becoming components inside repeatable operational systems. Defenders must evaluate the surrounding framework, permissions, memory, tools, and network access, not only the model’s text output.

Familiar Vulnerabilities Became a Scalable Attack Queue

AI agents increased the volume and continuity of established attack methods without making those methods technically new.

The campaign’s attempted Shellshock exploitation illustrates that pattern. Researchers found a payload aimed at the Kuomintang Party History Archives in Taiwan. It placed the Shellshock function prefix inside an HTTP User-Agent header and attempted to run a shell command.

The workspace also contained a client configured for a webshell path on an Indonesian Ministry of Foreign Affairs domain. That script encrypted commands before sending them to the remote server. Hunt.io presented it as evidence associated with targeting, not independent confirmation of the ministry’s complete compromise.

Another deployment script created 20 identical PHP webshells under filenames that resembled ordinary WordPress components. Once decoded, the files accepted encrypted commands and returned encrypted output. Their filenames were selected to blend into familiar application directories.

The GLUTTON tooling used a more unusual concealment method. Its loaders accepted PNG images and reconstructed executable bytecode from their red, green, and blue pixel values. An XOR operation decoded the data before the loader placed it into memory.

Steganography hides information inside another medium, such as an image. Here, the PNG acted as a transport container rather than a visible picture with a secret message. Security controls that inspected only file extensions or MIME types could miss the executable content.

Hunt.io found ten GLUTTON loader templates covering Java, ASP.NET, SOAP, and .NET Core environments. The visible server-side component remained a relatively generic decoder. The functional stage arrived later inside image data.

The operator also maintained a fake MySQL server as an initial-access tool. It selected a serialized Java object based on the username supplied by a connecting client. Vulnerable Java clients could then retrieve a Linux second-stage payload.

Deserialization turns stored data back into an executable object or program structure. Unsafe Java deserialization can allow attacker-controlled data to trigger code execution. The method is established, but packaging it as a reusable service makes repeated testing easier.

The AI layer helped coordinate these different methods. A worker could inspect a service, select a relevant procedure, generate commands, and preserve the results. Another worker could use the same evidence to attempt persistence or gather data.

This model pressures security teams that organize their work around a human attacker’s pace. Traditional detection may assume pauses between reconnaissance, exploit development, access attempts, and documentation. An agentic workflow can compress those stages and run several simultaneously.

The danger is especially acute around secondary systems. Test servers, backup applications, forgotten administrative portals, and old internet-facing services often receive less monitoring. Once compromised, they can become stepping stones into better protected environments.

Taiwan’s Ministry of Digital Affairs described that exact concern after a separate July incident. Its government response said overseas attackers combined human activity with AI-agent assistance and used secondary systems as pivots.

The ministry began issuing warnings on July 20 and said affected agencies subsequently completed response work. It did not name China. It also did not publicly establish that its incident was the same campaign documented by Hunt.io.

That separation is important. Similar tools, timing, geography, or tactics do not prove two reports describe one actor. Responsible analysis should preserve the boundaries between Hunt.io’s SecFlow evidence and Taiwan’s official statement.

The pressure on defenders remains consistent across both accounts. AI can help an attacker revisit old vulnerabilities, test many endpoints, and keep operational notes without fatigue. Patch latency and credential reuse become more costly when the opposing workflow scales cheaply.

Google News readers may see “AI agents” and imagine models inventing unknown techniques. The observed reality is less cinematic and more practical. Automation makes known attack paths easier to queue, retry, combine, and document.

Shared AI Memory Also Multiplied a False Positive

SecFlow’s coordination increased efficiency, but it also allowed one unsupported claim to contaminate later work.

Hunt.io found an early assertion that an Apache Shiro exploitation attempt had succeeded. The retained evidence did not support that conclusion. Nevertheless, later workers received assignments that treated the claimed access as real.

More than 27 follow-up tests failed. The agents still continued receiving GLUTTON deployment tasks based on the earlier result. Shared context turned one mistake into a persistent branch of wasted activity.

This failure matters because it sets a boundary around claims of autonomous hacking. Language models can misread tool output, infer success from ambiguous responses, or preserve an incorrect summary. Connecting more workers to the same memory can amplify that error.

The system did not display reliable independent judgment. It displayed operational persistence. Those properties can look similar from outside because both produce continued activity after an initial attempt.

A capable human operator still appears central. Someone chose targets, built infrastructure, configured routes, collected tools, and decided what objectives the workers should pursue. The AI layer expanded execution capacity within that human-designed environment.

This pattern matches evidence from other recent investigations. Palo Alto Networks’ Unit 42 documented a parallel campaign involving a Chinese-speaking operator using Hermes Agent with DeepSeek as its primary reasoning system.

Unit 42 said that operator used Telegram to direct autonomous enumeration and exploitation attempts. The agent searched for public exploit code and pivoted toward other vulnerabilities when initial paths failed. Human activity remained present alongside autonomous tasks.

That separate campaign produced limited confirmed impact. Unit 42 verified data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. The researchers said the autonomous attempts did not fully compromise their intended targets.

Unit 42 attributed its operator to Zhuhai, China, based partly on GitHub activity and related infrastructure. It characterized the person as an opportunistic exploit operator and self-described binary security researcher. It did not present the campaign as a confirmed state operation.

Anthropic reported another precedent in 2025. Its cyber espionage report described a suspected Chinese state-sponsored group that allegedly manipulated Claude Code during a campaign against about 30 organizations.

Anthropic said the model performed much of the operational workload after humans selected targets and approved major decisions. However, outside analysts questioned how the company measured autonomy and whether familiar automation was being reclassified as agentic behavior.

The SecFlow evidence offers a useful corrective to both hype and dismissal. The system was not infallible, and the tools were not entirely independent. Yet its retained files show that model-driven workers were integrated into live offensive infrastructure.

The false-positive episode does not make the framework harmless. Wasted tasks are inexpensive when automated, and occasional success can still produce serious damage. An operator can tolerate many failed branches if the system keeps testing targets at low marginal cost.

Defenders should therefore avoid two opposite mistakes. One is treating every AI-assisted intrusion as a fully autonomous cyber weapon. The other is dismissing the technology because agents hallucinate or require human supervision.

The relevant metric is operational leverage. How many targets can one person examine? How quickly can the workflow convert a finding into another task? How often does the system identify a viable path before detection?

Those questions are more useful than asking whether AI conducted every action without human involvement. Most consequential automation still has people setting goals and maintaining infrastructure. Human direction does not erase the scaling effect.

Attribution Remains Weaker Than the Technical Evidence

The campaign’s infrastructure is well documented, but the public record does not justify calling it a confirmed Chinese state operation.

Hunt.io linked the workspaces through shared network routes, file matches, repeated accounts, model gateways, and payload relationships. The username Nie appeared across portions of the model-service namespace and proxy accounts.

The operator used Chinese-language infrastructure and targeted systems across Taiwan, Indonesia, Vietnam, China, Afghanistan, and another country in the documented set. Some activity affected Chinese domestic organizations, including government and education systems.

Domestic targeting complicates a simple geopolitical narrative. It can indicate opportunistic scanning, criminal activity, security research that crossed legal boundaries, or an actor serving multiple objectives. It does not exclude intelligence collection, but it weakens any automatic state attribution.

The selection of government, political, consular, healthcare, education, telecommunications, and industrial targets is consistent with broad intelligence interests. It is also consistent with an operator searching widely for vulnerable public systems.

Hunt.io described confirmed compromises separately from attempted attacks and retained target material. That distinction should remain visible. Finding a domain in a workspace does not prove access, data theft, or institutional impact.

The public report provides strong evidence of compromise in the Fengtai government environment. It also documents access involving an education platform and a university database. Other targets have varying evidentiary strength.

The Security Affairs headline used the phrase “Chinese hackers,” while the underlying research used “Chinese-speaking operator.” The second description is more precise. A language assessment identifies an operational characteristic, not an employer or sponsor.

Taiwan has reported sustained pressure from China-linked cyber activity. Reuters’ Taiwan coverage cited an average of 2.63 million daily attacks against key infrastructure during 2025, a 6 percent annual increase.

Those statistics provide geopolitical context, but they do not attribute SecFlow. Taiwan’s August statement described an overseas source and AI-agent assistance without publicly naming China. Beijing did not provide an immediate response to Reuters regarding that incident.

Similar caution applies to the AI vendors. Evidence that SecFlow contained profiles for Claude, Qwen, and DeepSeek does not mean each provider knowingly enabled the campaign. A configured model endpoint also does not prove identical usage across every intrusion.

The available records show these models were treated as swappable workers. More detailed provider logs would be needed to establish which requests reached each service, which safeguards responded, and which accounts were disabled.

Proxy gateways further complicate that verification. A gateway can aggregate keys, redistribute capacity, or obscure which upstream account served a request. Providers can still retain safety signals, but public reporting rarely exposes enough data to reconstruct every interaction.

The attribution gap should influence defensive planning. Organizations do not need to determine an attacker’s sponsor before blocking a webshell, rotating stolen credentials, or isolating a compromised server. Technical indicators can drive response even when political identity remains uncertain.

However, governments and media outlets should keep the distinction clear. Calling a Chinese-speaking operator “state-backed” without additional evidence can turn a technical investigation into an unsupported geopolitical claim.

A Google News headline compresses an event into a few words. Security teams need the longer version: confirmed access, attempted access, infrastructure links, model configurations, and attribution are separate layers of evidence.

What Defenders Should Watch After the Google News Headline

The next test is whether AI orchestration becomes repeatable across actors, not whether one framework receives a dramatic label.

The first signal is replication. Researchers should watch for other exposed or seized environments that divide reconnaissance, exploitation, persistence, collection, and reporting among specialized workers.

Repeated architecture across unrelated operators would show that SecFlow reflects a broader operating model. If the pattern remains limited to a few technically capable individuals, the immediate threat stays narrower.

The second signal is provider-side intervention. Claude, Qwen, DeepSeek, and other model providers can examine abusive request patterns, suspicious tool use, proxy gateways, and repeated exploit-development behavior.

Public disclosures about account suspensions or new safeguards would show that providers can detect portions of the workflow. Continued campaigns using pooled credentials and intermediary gateways would demonstrate the limits of account-level controls.

The third signal is defender response time. AI-assisted operations become more consequential when organizations take days to patch exposed systems or investigate credential anomalies. Faster containment would reduce the advantage created by parallel agent tasks.

Security teams should prioritize internet-facing administrative applications, forgotten test systems, exposed databases, and remote-management interfaces. They should also search for webshell behavior rather than relying only on suspicious filenames.

Image uploads deserve closer inspection when server-side code can read and execute their contents. Monitoring should include unusual in-memory loading, unexpected class creation, command interpreters launched by web processes, and outbound connections from administrative servers.

Credential controls matter just as much. Organizations should protect LSASS, rotate secrets after suspected web-tier access, restrict database service accounts, and separate production credentials from application configuration files.

Network segmentation can limit damage after an initial foothold. A public web server should not automatically reach credential stores, internal databases, management dashboards, and file repositories. Every unnecessary connection expands an agent’s available action space.

Teams also need evidence quality inside their own automation. Defensive agents can repeat the same failure seen in SecFlow if they accept an unsupported result. Security workflows should preserve raw tool output, require confidence checks, and distinguish verified access from model inference.

That lesson extends beyond cybersecurity. Any organization using tool-enabled agents should treat shared memory as both an asset and a risk. A false summary can guide later actions unless the system keeps provenance and verification close to every claim.

Readers following the story through Google News should resist the simplest interpretation. The campaign does not prove that AI can independently conquer hardened networks. It shows that AI can organize established offensive work inside a persistent, reusable system.

That finding is consequential enough. One operator can preserve procedures, parallelize tasks, and move findings between models without building a new exploit for every target. Even an error-prone system can increase pressure when failed attempts cost little.

The practical question is whether your organization can recognize that tempo before an exposed secondary system becomes a bridge to critical data. Review external assets, credentials, agent access, and response procedures now. The next campaign may use different models and another framework, but the operating principle will look familiar.