Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries

Reported 14 Jul 2026 by otx · Severity: medium

In June 2026, infrastructure pivoting from TencShell C2 nodes revealed an active intrusion campaign utilizing AI language models for attack automation. Thirteen Hong Kong-based servers across four ASNs exposed an open directory containing victim source code, custom exploits, oper