Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries

This intrusion campaign, active as of June 2026, involves suspected Chinese operators using AI-powered tools—Claude Code for execution and DeepSeek-v4-pro for attack logic—to automate and orchestrate attacks against government and financial sectors across multiple countries. The attackers deployed TencShell implants and webshells, leveraging custom exploits such as SQL injection and Laravel deserialization vulnerabilities to gain administrative access and exfiltrate sensitive information. Evidence was uncovered on multiple Hong Kong-based servers revealing operational artifacts and victim data. The campaign includes reconnaissance against U.S. government portals and targets financial firms in Europe, Australia, and Asia. The operation uses supply chain targeting and phishing tactics as part of its attack vectors.

Successful exploitation allowed attackers to compromise administrative systems of government entities and financial firms, leading to exfiltration of sensitive data including citizen complaints and government employee information. The campaign's use of custom exploits and webshell implants indicates a high level of operational capability and persistence. The exposure of victim source code and operational logs on attacker infrastructure suggests significant operational security lapses by the threat actors but also indicates the breadth and depth of the compromise. The targeting of multiple countries and sectors highlights the campaign's broad impact potential.

No official patch or remediation guidance is provided in the available information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should monitor for indicators related to TencShell implants, webshells, and the specific exploit techniques mentioned (SQL injection, Laravel deserialization). Given the use of AI-powered automation, enhanced detection of anomalous execution patterns and network traffic associated with Claude Code and DeepSeek tools is recommended. Organizations in the affected sectors and regions should review access controls, audit logs, and implement protections against the identified exploit techniques. Phishing defenses should be strengthened to mitigate initial access vectors. Note that this is an active campaign; timely threat intelligence updates are critical.