A China-linked operator used AI agents to attack governments across Asia.

During routine threat infrastructure hunting, a VPS hosted in the Asia-Pacific region was found exposing an autonomous AI intrusion platform with no authentication, containing over 150 live campaign files. Subsequent analysis by vulnonhq recovered extensive evidence and mapped 66 active intrusion projects linked to a China-affiliated operator. Of these, 48 operations achieved some level of access, and 6 escalated privileges to root or SYSTEM level. The campaign targeted high-profile government agencies in Vietnam, Taiwan, Indonesia, and India, alongside commercial sectors such as airlines, payments, and retail across Asia. This represents a sophisticated use of AI-driven automation in cyber espionage and intrusion campaigns.

The campaign resulted in unauthorized access to sensitive government and commercial networks across multiple Asian countries, with several intrusions achieving elevated privileges. This compromises confidentiality, integrity, and potentially availability of targeted systems, posing significant risks to national security and critical infrastructure. The use of autonomous AI agents suggests a high level of operational sophistication and persistence.

No specific remediation or patch is applicable as this is an active threat campaign rather than a software vulnerability. Organizations in the affected sectors should review their network exposure, especially services accessible without authentication, and enhance monitoring for unauthorized access. Collaboration with threat intelligence providers and incident response teams is recommended to identify and mitigate ongoing intrusions. The vendor or operator of the exposed infrastructure is not applicable; mitigation relies on defensive security controls and threat hunting.