How SecFlow Used Claude, Qwen and DeepSeek in an AI-Assisted Cyberespionage Campaign

Hunt.io’s reporting describes an AI-assisted espionage operation in which a framework called SecFlow broke campaign goals into specialized tasks, maintained shared operational context, and coordinated model-backed workers. The important distinction is that the AI layer organized work; human operators still chose targets and methods, while familiar offensive tooling performed the underlying intrusion and persistence activity. 2

What SecFlow did

According to Hunt.io, SecFlow could translate a high-level objective into discrete reconnaissance, vulnerability-validation, exploitation, collection, and reporting tasks. Workers could share target settings, files, session history, proxy routing, generated evidence, and report output—giving the campaign a reusable operational workspace rather than a collection of isolated prompts. 2

The recovered configuration reportedly allowed operators to swap among Claude, Qwen, and DeepSeek-labelled profiles without changing the task interface. Model traffic included private endpoints in the niestools.com namespace as well as direct routes to DeepSeek and Alibaba DashScope/Qwen services. That mixed routing matters: it is not evidence that every action was performed through an official provider endpoint. 2

Hunt.io said the recovered activity included targets in Taiwan, Indonesia, mainland China, and Vietnam, including government, education, consular, and industrial environments. 2

AI coordination did not replace conventional intrusion tools

The framework appears to have been an orchestration layer around conventional offensive activity, not a system independently inventing and executing novel attacks. Hunt.io observed workflows involving known vulnerability classes and public proof-of-concept material, credential use, scripts, web-accessible ASPX components, payloads, and custom implants. 2

One post-compromise component was SecBox, a Go-based implant that Hunt.io identified alongside webshells and other tooling. The reported evidence indicates that these conventional tools provided access and operational capability, while SecFlow helped sequence, assign, and document tasks around them. 2

That model is a more useful way to interpret the case than calling it “autonomous hacking”: AI can reduce coordination overhead and accelerate repeated research or validation work, yet a campaign can remain dependent on operator decisions, pre-existing exploits, and established malware tradecraft.

The infrastructure links—and their attribution limits

Hunt.io linked five exposed attacker workspaces through a shared authenticated SOCKS endpoint. Its reported connections included matching file content, shared SecFlow and GLUTTON artifacts, reused accounts, and a delivery relationship between a fake-MySQL environment and a second-stage payload host. The company assessed the environments as serving different roles, including AI orchestration, exploitation testing, fake-MySQL deserialization, credential testing, and payload distribution. 2

Simplified Chinese notes and artifacts, plus recurring use of the Nie handle in private model-service and proxy accounts, led Hunt.io to assess the activity as connected to Chinese-speaking operators. Those indicators are meaningful investigative clues, but they do not independently establish a specific individual, group, or government sponsor. 2

A key failure: the Apache Shiro false positive

The campaign also illustrates a central risk in multi-agent systems: a bad intermediate conclusion can become assumed fact for every downstream worker.

Hunt.io reported that a worker claimed Apache Shiro exploitation had succeeded without sufficient support. Subsequent GLUTTON assignments treated that assertion as ground truth, producing more than 27 failed follow-up tests. 2

For defenders—and for anyone building high-stakes agent workflows—the lesson is straightforward: task routing and shared memory make a system faster, but they also amplify unverified findings. Independent confirmation gates are necessary before an agentic workflow escalates from detection to exploitation, collection, or remediation decisions.

What was confirmed in the Fengtai District case

Hunt.io characterized a Fengtai District government environment as the most extensive confirmed compromise in its material. It reported command execution, access to government and health records, collection of LSASS memory and Windows registry hives, and deployment of multiple Windows implants. 2

The researchers also described an approximately 75.8 MB LSASS dump placed in an OA attachment repository and retrieved through ASPX handlers over the shared proxy route. Web-accessible handlers and deployed implants, including SecBox, are supported as access or persistence-related components in the available evidence. However, the reported material does not establish a precise autostart mechanism—such as a particular service, scheduled task, or registry Run key—for every implant. 2

How this compares with earlier AI-enabled campaigns

Hunt.io explicitly described the SecFlow activity as a second, separate campaign from its July 2026 report on suspected Chinese operators using Claude Code and DeepSeek against government and financial targets in four countries. The campaigns had different infrastructure, tooling, and targets, though both reportedly used commercial models as operational components. 220

The SecFlow case also resembles Anthropic’s November 2025 disclosure of an AI-orchestrated espionage campaign attributed by Anthropic to a Chinese state-sponsored group it called GTG-1002. Anthropic said that campaign used Claude Code to attempt intrusions against roughly 30 targets and employed AI across stages including reconnaissance, vulnerability work, exploitation, credential access, data analysis, exfiltration, and documentation. 46

The resemblance is operational, not attributional. The available reporting does not show that SecFlow’s operators were GTG-1002, nor does it establish that Anthropic’s official Claude service directly enabled the SecFlow activity. The private relays and mixed API configuration are precisely why those distinctions should be preserved. 246

The broader takeaway

SecFlow is notable because it points to a practical near-term pattern: attackers can use multiple models as interchangeable planning and coordination workers while retaining traditional exploitation and malware infrastructure. The case also shows why AI-assisted campaigns should not be overstated as hands-off automation. Their effectiveness may come from faster task decomposition and iteration, but their weakest assumptions can propagate quickly unless a human—or a rigorous validation process—catches them. 2