Chinese-Speaking Operator Used AI Agents to Target Government and Education Systems Across Asia

Sep 3, 2026 · Original article ↗

Summary

Hunt.io links five exposed workspaces to a Chinese-speaking operator using AI agents and conventional exploits. The campaign compromised government and education systems, stealing credentials and records and deploying webshells and SecBox implants.

Key points

Hunt.io connected five exposed workspaces through shared proxy infrastructure, accounts and tooling, linking activity across six countries and nearly a dozen sectors.
The SecFlow framework assigned reconnaissance, exploitation, collection and reporting tasks to Claude, Qwen and DeepSeek workers; exploitation relied on conventional scripts, public proof-of-concept code, credentials and custom tools.
In a Fengtai District government environment, the operator gained command execution, collected LSASS data and registry hives, accessed government and health records, extracted 822 OA account records and deployed Windows implants.
An education AI platform's unauthenticated backend exposed agent configurations, credentials and dialogue records. Leaked credentials were used against production services, exposing additional conversations and student-profile information.
The investigation also found root database and Grafana administrator access to a university campus-card system, and a fake MySQL service designed to trigger Java deserialization and deliver a second-stage implant.
The campaign tested or staged workflows involving eight CVEs and used webshells, including GLUTTON loaders that concealed executable payloads in PNG image data. Not every vulnerability attempt succeeded.
Hunt.io says it disclosed the findings to relevant national CERTs under TLP:AMBER and delayed publication until September 3, 2026.

Article Details

Attack Vectors: The operator used an OA FileManage handler to upload web-accessible ASPX command shells into the Fengtai government environment.
A malicious MySQL-compatible service returned crafted serialized Java objects to connecting vulnerable clients, triggering a platform-aware second-stage downloader.
Shellshock payloads placed a Bash command chain in the User-Agent header of requests to the KMT Party History Archives.
The operator used exposed AI-platform management services and disclosed application credentials to access configurations, conversations and production Dify APIs.
SecFlow workers tested or staged the eight listed CVEs; the article distinguishes probes and prepared payloads from successful access.
Defensive Notes: The recovered reporting workflow required control requests, reproducible results, impact evidence and severity checks, but an unsupported Shiro success claim propagated despite more than 27 unsuccessful follow-up tests.
The education AI-platform evidence confirms an accepted unauthenticated configuration-write request, but does not establish that the configuration persisted, its external URL was accessed, or SSRF or backend code execution occurred.
No automatic persistence mechanism was confirmed in the reviewed SecBox builds; the Fengtai operator separately created and verified a privileged OA application account.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`niestools[.]com`	Operator-controlled domain family used for model relays, proxy management and GLUTTON authorization.
HOSTNAME	`claude[.]niestools[.]com`	Operator-controlled private Claude model relay used by SecFlow.
HOSTNAME	`deepseek[.]niestools[.]com`	Operator-controlled private DeepSeek-compatible model relay used by SecFlow.
HOSTNAME	`proxy[.]niestools[.]com`	Operator-associated proxy-pool management console.
IPV4	`103[.]45[.]65[.]93`	Shared authenticated SOCKS5 relay used across operator workspaces.
IPV4	`129[.]211[.]184[.]149`	Operator payload-distribution, C2 and post-exploitation host.
IPV4	`152[.]42[.]200[.]25`	Operator Shellshock and credential-testing workspace and callback listener.
IPV4	`158[.]247[.]234[.]124`	SecBox payload host and DDR-supplied redirector.
IPV4	`159[.]223[.]64[.]67`	Operator workspace hosting the malicious MySQL-compatible deserialization service.
IPV4	`207[.]148[.]109[.]245`	Earlier plaintext SecBox DDR redirector.
IPV4	`211[.]159[.]155[.]240`	SecFlow gateway listed in the operator-infrastructure indicators.
IPV4	`43[.]162[.]217[.]10`	Primary authenticated SOCKS5 route configured for SecFlow tasks.
IPV4	`43[.]99[.]61[.]170`	Operator Java/CAS exploitation workspace with GLUTTON tooling and a JNDI listener.
IPV4	`81[.]70[.]240[.]170`	Operator AI-orchestration workspace, SSH jump host and egress point.
SHA256	`00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2`	GLUTTON injector intended for execution inside a victim Java application.
SHA256	`053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302`	Victim-side file-management webshell found as doc_helper.aspx and doc_view_666b2dde.aspx.
SHA256	`0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e`	Windows SecBox payload staged and executed on the Fengtai OA host.
SHA256	`135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141`	Victim-side downx.aspx file reader with XOR-obfuscated transfers.
SHA256	`1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736`	Victim-executed Java deserialization second-stage downloader payload.
SHA256	`20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4`	Windows SecBox-compatible multiprotocol implant, agent_new.out.
SHA256	`218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd`	MethodInvoker.class in-memory filter component.
SHA256	`27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6`	Victim-executed Java deserialization callback and downloader payload.
SHA256	`2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277`	Obfuscated JSP loader for a PNG-carried in-memory payload.
SHA256	`3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a`	Windows implant build staged under multiple filenames.
SHA256	`4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273`	Linux SecBox-compatible implant variant.
SHA256	`548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091`	Victim-side dl_icn.aspx downloader for c22.exe.
SHA256	`77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611`	Victim-executed Spring gadget-chain downloader delivered through the fake MySQL workflow.
SHA256	`797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064`	Victim-side sqldump.aspx OA database extraction payload.
SHA256	`79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1`	Victim-side launchfw.aspx downloader and implant launcher.
SHA256	`80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0`	Victim-side dl_e6.aspx SecBox loader.
SHA256	`853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf`	Redis-assisted GLUTTON payload writer targeting victim Java applications.
SHA256	`9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e`	Victim-side extract.aspx LSASS-dump scanner.
SHA256	`a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4`	Victim-side potato4.aspx privilege-escalation payload.
SHA256	`af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee`	Victim-side sql6.aspx arbitrary SQL interface.
SHA256	`dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541`	Victim-side down.aspx arbitrary-file range reader used for exfiltration.
SHA256	`e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47`	Obfuscated Node.js loader for a PNG-carried in-memory payload.
SHA256	`eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412`	Retained Windows implant sample assessed as a candidate for the c22.exe-to-fw.exe deployment path.
SHA256	`f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc`	WebLogic or CAS ticket-interception GLUTTON variant.
SHA256	`f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c`	Victim-side dl_v11.aspx SecBox downloader.
URL	`hxxp[:]//129[.]211[.]184[.]149:8443/999b4e8c/public/dnc/a6d28ebe?os=<os>&arch=<arch>`	Operator second-stage implant download URL used by the fake MySQL deserialization payloads.
URL	`hxxp[:]//158[.]247[.]234[.]124:18000/c22[.]exe`	SecBox implant download URL used by victim-side ASPX loaders.
URL	`hxxps[:]//glutton[.]niestools[.]com`	Operator-controlled GLUTTON MCP authorization endpoint hardcoded in its binaries.