As reported by SecurityAffairs, threat intelligence firm Hunt.io has documented a China-linked espionage campaign that operationalizes commercial AI models — Claude, Qwen, and DeepSeek — as coordinated workers within an attack framework dubbed SecFlow. The campaign targeted government, education, and industrial systems across Taiwan, Indonesia, Vietnam, and mainland China. This is not another story about AI-generated phishing lures. It is the disclosure of a working, multi-agent orchestration platform wired directly into live intrusion operations.

Threat Intelligence: As reported by SecurityAffairs, threat intelligence firm Hunt.io has documented a China-linked espionage campaign that operationalizes commercial AI models — Claude, Qwen, and DeepSeek — as coordinated workers within an attack framework dubbed SecFlow.

Why This Matters: Orchestration, Not Just Generation

The cybersecurity community has spent considerable energy debating whether AI models can autonomously discover and exploit vulnerabilities. That debate misses the point. SecFlow demonstrates that the immediate threat is not autonomous hacking — it is orchestration. The framework assigns specialist roles to AI workers: reconnaissance, exploitation, credential testing, payload deployment, data collection, and reporting. The models do not need to invent novel exploits. They automate and accelerate the tedious, repetitive tasks that consume the bulk of an operator's time.

The operational impact is straightforward: a single operator can now manage multiple simultaneous intrusion paths with AI handling the drudgery of scanning, credential validation, and post-exploitation triage. This compresses the time from initial access to data exfiltration and scales campaign throughput without scaling headcount.

The Multi-Model Architecture Is the Real Story

SecFlow's ability to swap between Claude, Qwen, and DeepSeek without changing the task interface is architecturally significant. It means the operators have built an abstraction layer over commercial LLM APIs, making their infrastructure resilient to any single provider cutting off access. The use of private proxy servers tied to the niestools.com domain — rather than official API endpoints — indicates deliberate evasion of provider usage policies and attribution tracking.

This has uncomfortable implications for AI providers. Content moderation and usage policy enforcement at the API level becomes far less effective when threat actors route requests through intermediary proxies that obscure the true origin and intent of calls. The industry's current approach of monitoring for policy-violating prompts on official endpoints is insufficient against this model.

OpSec Failures Cut Both Ways

The campaign was reconstructed from five accidentally exposed open directories. This is a reminder that even capable operators make infrastructure mistakes, and open directory exposure remains one of the highest-yield sources of threat intelligence. Defenders and researchers should continue treating exposed directories as priority collection opportunities — they often reveal the full operational stack that threat actors would prefer to keep hidden.

Who Is at Risk

OpSec Failures Cut Both Ways
Government agencies across Southeast and East Asia, particularly those with internet-facing web applications running Java/CAS or other exploitable frameworks
Education institutions with campus-card or identity management systems that expose database access through application-layer vulnerabilities
Industrial operators in Vietnam and the broader region whose hosts may be targeted for collection rather than disruption
Any organization running internet-facing services with known deserialization or command injection exposure — SecFlow automates the identification and exploitation of these classes

Shield53 Recommendations

  • Monitor for AI-orchestrated attack patterns: Look for rapid, parallel probing across multiple vectors from related infrastructure — this is the signature of agent-driven reconnaissance rather than manual scanning. Correlate timing and source IP clusters to identify orchestration.
  • Hunt for the infrastructure, not just the AI: The niestools.com proxy domain and associated IP infrastructure should be blocked and monitored. Threat actors who proxy LLM API calls need stable intermediary infrastructure — that is your detection surface.
  • Assume compressed attack timelines: With AI automating post-exploitation tasks like credential extraction (LSASS dumps, registry hives) and web shell deployment, the window between initial access and data exfiltration shrinks. Detection and response playbooks must account for faster adversary execution.
  • Prioritize internet-facing application hardening: SecFlow's confirmed intrusions achieved command execution through web applications. Patch deserialization flaws, restrict CAS and Java framework exposure, and implement WAF rules for known exploit patterns. The AI does not invent new exploits — it automates exploitation of known classes at scale.
  • Watch for open directory exposures in your own environment: If Hunt.io found five directories from the attacker's side, consider what your organization might be exposing. Run external attack surface management scans for unintended directory listing or file exposure.
  • Brief leadership on AI-amplified threat: This is not a future risk. It is present-day operational reality. The conversation should shift from "will AI be used in attacks" to "how do we detect and respond to AI-accelerated intrusion campaigns."

The SecFlow campaign is a working proof of concept for AI-amplified espionage at scale. It will not be the last. Organizations that continue treating AI-enabled attacks as a hypothetical concern are already behind the operational curve.