Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

    Friday, September 4, 2026 In: Threat Research Print

    Date: 09/04/2026

    Severity: High

    Summary

    A Chinese-speaking threat operator used AI agents powered by Claude, Qwen, and DeepSeek to automate reconnaissance, exploitation, credential collection, and reporting against government, education, and industrial targets across Asia. The SecFlow framework coordinated specialized AI workers and leveraged eight known CVEs, including Log4Shell, Spring4Shell, Ghostcat, Shellshock, Shiro deserialization, Grafana/Nexus path traversal, and Nacos authentication bypass. Confirmed compromises included command execution, LSASS and registry-hive theft, government and health-record access, and university database compromise, demonstrating how AI can amplify large-scale intrusion operations.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    tcp://imported-concerns-listening-typing.trycloudflare.com

    tcp://marriage-step-wave-heavy.trycloudflare.com

    wss://wins-say-charm-social.trycloudflare.com/c2

    %.niestools.com

    IP Address

    81.70.240.170

    43.99.61.170

    152.42.200.25

    129.211.184.149

    159.223.64.67

    129.211.184.149

    129.211.184.149

    158.247.234.124

    207.148.109.245

    103.45.65.93

    43.162.217.10

    211.159.155.240

    Hash

    20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4

    0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e

    3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a

    4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273

    eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412

    dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541

    135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141

    9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e

    797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064

    af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee

    053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302

    053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302

    80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0

    f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c

    548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091

    79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1

    a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4

    00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2

    f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc

    853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf

    218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd

    2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277

    e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47

    1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736

    27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6

    77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "tcp://imported-concerns-listening-typing.trycloudflare.com" or siteurl like "tcp://imported-concerns-listening-typing.trycloudflare.com" or url like "tcp://imported-concerns-listening-typing.trycloudflare.com" or domainname like "tcp://marriage-step-wave-heavy.trycloudflare.com" or siteurl like "tcp://marriage-step-wave-heavy.trycloudflare.com" or url like "tcp://marriage-step-wave-heavy.trycloudflare.com" or domainname like "wss://wins-say-charm-social.trycloudflare.com/c2" or siteurl like "wss://wins-say-charm-social.trycloudflare.com/c2" or url like "wss://wins-say-charm-social.trycloudflare.com/c2" or domainname like "%.niestools.com" or siteurl like "%.niestools.com" or url like "%.niestools.com"

    Detection Query 2 :

    dstipaddress IN ("152.42.200.25","81.70.240.170","211.159.155.240","158.247.234.124","43.162.217.10","129.211.184.149","103.45.65.93","43.99.61.170","159.223.64.67","207.148.109.245") or srcipaddress IN ("152.42.200.25","81.70.240.170","211.159.155.240","158.247.234.124","43.162.217.10","129.211.184.149","103.45.65.93","43.99.61.170","159.223.64.67","207.148.109.245")

    Detection Query 3 :

    sha256hash IN ("20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4","0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e","3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a","4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273","eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412","dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541","135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141","9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e","797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064","af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee","053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302","053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302","80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0","f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c","548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091","79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1","a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4","00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2","f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc","853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf","218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd","2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277","e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47","1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736","27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6","77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611")

    Reference:    

    https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia#Indicators_and_observables              


    Tags

    Credential HarvestingGovernment Services and FacilitiesEducationAsiaMalwareThreat ActorChinaAIExploitation

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.