AI-Powered Cyber Espionage Campaign Targets Government Entities in Asia In June 2026, security researchers uncovered an active cyber espionage campaign leveraging AI models Claude Code and DeepSeek-v4-pro to compromise government organizations in Afghanistan, Thailand, and Taiwan. The operation, linked to suspected China-aligned threat actors, was identified after analysts traced infrastructure associated with TencShell, a Go-based implant previously flagged by Cato CTRL for similar activity. The investigation began with an exposed server (112.213.124[.]132), which contained a trove of malicious assets, including victim source code, exploit tools, phishing templates, operator logs, and malware samples all documented in Simplified Chinese. The threat actors employed a split-model workflow: DeepSeek-v4-pro handled attack reasoning, exploit adaptation, and script generation, while Claude Code managed command execution, persistent sessions, and phishing page development. This marks the second documented case of suspected China-linked operators using Claude Code in cyber operations, following a November 2025 disclosure by Anthropic. The campaign’s infrastructure, primarily hosted in Hong Kong by providers like VMISS Inc., MEGA-II IDC, CTG Server Limited, and Antbox Networks Limited, included 13 servers sharing a unique HTTP header fingerprint. The exposed server hosted multiple services, such as: - SSH (port 222222) - Malware download service (port 111111111111) - DeepAudit (port 300030003000) – a legitimate open-source tool repurposed for reconnaissance - ARL (port 500350035003) – another open-source tool used for malicious scanning - Vshell (port 808480848084) – command-and-control software - Open HTTP directory (port 888888888888) – containing 2,431 files and 80 subdirectories, including web shells, database dumps, exploit scripts, and cloned government login pages The directory also revealed Linux malware compiled for ARM systems, designed to steal cloud access keys, enterprise credentials, and Tencent QQ/IM data, while enabling file exfiltration. Researchers identified shared SSH host keys and default ARL TLS certificates across three servers, indicating coordinated infrastructure. Additionally, a potential second C2 framework, "Gshell," was detected, with overlapping servers suggesting the operators use multiple frameworks in tandem. The campaign underscores the growing use of AI-driven tools in state-sponsored cyber operations, blending legitimate software with custom malware to evade detection and enhance attack efficiency.