A cyberattack operation targeting public-sector, political and education organizations across Asia has moved agentic artificial intelligence from experiment to operational infrastructure. The attackers used commercial models including Claude, Qwen and DeepSeek to help break broad objectives into smaller tasks, preserve findings between steps and coordinate reconnaissance, exploitation and reporting. The campaign still depended on familiar weaknesses—exposed servers, vulnerable applications, stolen credentials and webshells—but AI allowed the operators to organize those techniques at greater speed and scale.

Researchers connected activity affecting Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education environments in mainland China. The clearest confirmed compromise involved a government network in Beijing’s Fengtai District, where attackers accessed administrative and health information, harvested Windows credentials and installed persistent tooling.

SecFlow turns objectives into specialist jobs

The operation centered on a framework called SecFlow. Instead of asking one model to handle an entire intrusion, the platform assigned narrower jobs to specialized AI workers. Operators could switch among Claude, Qwen and DeepSeek profiles through a shared interface while keeping target information, storage, proxy routes and tool permissions available across the workflow.

This structure matters because it lets one worker’s discovery become the next worker’s starting point. Reconnaissance results can feed exploit testing, which can then trigger collection or reporting tasks without rebuilding context manually. Researchers traced five connected workspaces through a shared SOCKS proxy and found related infrastructure, reusable accounts, SecFlow files and payload material tied to a toolset called GLUTTON.

AI did not invent the vulnerabilities or eliminate the need for hands-on tradecraft. The campaign used public proof-of-concept code, credential testing, webshells and a custom remote-access implant. In one revealing failure, an unsupported claim that Apache Shiro had been successfully exploited propagated into later instructions and led to more than 27 unsuccessful follow-up tests. Automation accelerated the workflow, but it also multiplied an early error.

Confirmed breach moved from a web app to internal systems

In the Fengtai incident, initial access came through an Office Automation application that permitted ASPX uploads. Server-side command pages then gave the attackers a route to execute Windows commands, enumerate internal systems, attempt privilege escalation and search for valuable credentials. The intruders pulled information from LSASS memory and registry hives, queried databases and moved data over ordinary HTTP requests.

They also created a privileged application account and staged SecBox, a Go-based remote-access and network-pivot utility. Its capabilities included command execution, file transfer, port scanning and traffic proxying, with alternate command channels available if the primary route failed. That combination could support continued access well after the vulnerable web application was first breached.

Other exposed systems showed different levels of impact. An education AI-management service revealed agent settings, secrets, conversations and student profiles. Researchers verified that leaked credentials worked against a production API and that an unauthenticated request could create an agent configuration, although they did not confirm full server takeover. Elsewhere, a fake MySQL service attempted to exploit unsafe Java object processing and deliver a Linux second stage.

Conventional defenses remain the priority

The campaign’s use of AI changes tempo more than fundamentals. Defenders should focus on reducing the openings the agents attempted to exploit and on detecting the behavior that follows a successful breach.

• Patch internet-facing applications quickly and remove exposed development directories, dashboards and administrative interfaces.
• Rotate credentials and API secrets found in public files, logs or poorly protected services.
• Hunt web servers for unexpected ASPX, JSP and PHP files, including loaders disguised as images or WordPress components.
• Monitor credential-dumping behavior, unusual database queries, new privileged application accounts and outbound proxy traffic.
• Segment public web systems from sensitive databases and endpoints so one successful upload cannot become an enterprise-wide foothold.

Why this campaign matters

The incident is evidence that attackers can use several AI models as interchangeable workers inside a repeatable attack process. It does not demonstrate an autonomous system discovering magical new exploits. Rather, it shows a practical orchestration layer that helps operators reuse knowledge, parallelize work and keep pressure on multiple targets.

Security teams should apply the same skepticism to automated offensive findings that they use for any alert: validate claims, preserve evidence and distinguish attempted exploitation from confirmed access. At the same time, they should assume that faster coordination will shrink the interval between public exposure and hostile testing. Strong asset inventory, prompt remediation and behavior-based monitoring are the controls most likely to hold up as attacker tooling evolves.