This intrusion campaign, attributed to suspected Chinese operators, employed AI language models (Claude Code) and DeepSeek-v4-pro to automate attacks against government and financial sectors across multiple countries. The attackers used TencShell C2 nodes and implants, webshells, and custom exploits such as SQL injection and Laravel deserialization to gain administrative access and exfiltrate sensitive data. Infrastructure pivoting revealed thirteen Hong Kong-based servers with open directories exposing victim source code, custom exploits, operational logs, and cloned login pages annotated in Simplified Chinese. Targets included government systems in Afghanistan, Thailand, Taiwan, and reconnaissance against U.S. government portals, as well as financial services firms in Europe, Australia, and Asia. The campaign combined multiple attack techniques including phishing, supply chain targeting, and credential access.

Successful exploitation resulted in administrative system compromise and exfiltration of sensitive government data including citizen complaints and government employee information. The campaign also conducted reconnaissance on U.S. government portals and targeted financial services firms internationally, indicating potential for broader operational impact. The use of custom implants and exploits demonstrates a sophisticated threat capable of persistent access and data theft.

No specific patches or fixes are available as this is an active intrusion campaign using custom tools and exploits. Organizations should review their exposure to the described attack techniques (SQL injection, Laravel deserialization, webshells, implants) and strengthen detection and response capabilities accordingly. Since this is not a cloud service, remediation depends on affected organizations applying relevant security controls and incident response. Patch status is not yet confirmed — check vendor advisories and threat intelligence updates for any emerging fixes or mitigations.