OTX Threat: Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries

In June 2026, infrastructure pivoting from TencShell C2 nodes revealed an active intrusion campaign utilizing AI language models for attack automation. Thirteen Hong Kong-based servers across four ASNs exposed an open directory containing victim source code, custom exploits, operational logs, and cloned login pages with notes in Simplified Chinese. The operation employed Claude Code for execution Sectors: Government, Finance, Telecommunications