China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia
Do Son 
| At a glance | |
| Actor | Unnamed China-linked, Chinese-speaking operator; suspected to be one person or a very small group |
| Activity | AI agent-driven intrusions, credential theft, and webshell deployment |
| Targets | Government bodies in Vietnam, Taiwan, Indonesia, and India, plus payments, retail, travel, and SaaS firms |
| Scale | 66 projects; 48 reached some access, per the operator’s own records |
| Status | No arrests or charges; VULONE has referred identification leads to the relevant parties |
| Source | VULONE Research Team, with context from Gambit Security reporting |
TL;DR
Between September 24 and October 14, 2026, a suspected China-linked operator ran 66 hacking operations from one server using AI agents. According to VULONE, the AI-driven hacking campaign hit ministries in Vietnam, Taiwan, Indonesia, and India. The operator’s own records claim 48 targets reached some level of access.
What happened
The investigation began with a tip from researcher @TheM3gatr0n on X. VULONE then found a server sharing its entire temp folder on the open internet. The folder had no password, no IP limits, and no rate limits. It stayed exposed from September 29 to October 15.
That folder belonged to an attack platform built on Cairn, an open-source framework that drives AI agents. VULONE says it then accessed the host “under authorization” and preserved 16.4 GB of hashed evidence.
Agents doing the heavy lifting
The setup was simple but large. One dispatcher sent jobs to up to 116 short-lived Kali Linux containers. Each container ran an AI agent backed by a DeepSeek model. Over twelve days, the dispatcher logged about 230,000 events. One gateway key processed roughly 36.7 billion tokens.
To keep costs down, the operator used six paid subscriptions and a farm of 16 CodeBuddy accounts. A scheduled task logged into each account daily to collect free credits. VULONE calls this “a cost-avoidance pattern we had not seen documented before.”
The operator set a strict goal for every job. A run only counted as done once it reached “a webshell or system command execution.” Panel or app access alone did not count.
Hiding the language trail
Notably, every prompt carried a rule the operator called the “highest red line.” All payloads, files, and comments sent to victims had to be in plain English. As a result, the intrusions would look English-speaking from the victim’s side. VULONE warns that “language signals left on a compromised host can therefore be manufactured.”
Who is behind it
VULONE assesses with high confidence that one operator or a very small group ran the platform. However, the actor’s identity remains unknown, and no one has been charged.
Several clues point to China. Script comments, task hints, and commit messages appear in Simplified Chinese. Part of the funding also ran through a Tencent-operated AI service. Still, VULONE says it “found no evidence of state sponsorship” and judges the motive to be financial. The operator’s location is also unknown. One session came from a mobile connection in Kenya.
Not the SOUL campaign
In late September, Gambit Security reported a separate AI-driven campaign called “SOUL.” That campaign also used Cairn with a similar DeepSeek model. VULONE compared the two and found no shared infrastructure, victims, or data. Its conclusion: the tooling overlap is real, but “the attribution overlap is not established.”
Impact and scale
The government list in this AI-driven hacking campaign stands out. It includes Vietnam’s Ministry of Defence and Ministry of Public Security. It also includes Taiwan’s Legislative Yuan, Indonesia’s State Intelligence Agency, and India’s CDAC. Corporate targets reportedly included China Airlines, Air India, Juspay, and Hertz.
These access claims come from the operator’s own tools. VULONE verified the strongest cases against logs, but victims have not publicly confirmed them. According to the records, six projects reached root or SYSTEM, 39 reached command execution, and three reached a webshell.
The methods were mostly basic. The operator relied on public exploits, default passwords, and old bugs, including a 2010 JBoss flaw. Collected data included internal host details, database credentials, admin API tokens, and source code. VULONE found no evidence of bulk card theft or destructive activity.
How to stay protected
Based on the findings, defenders should:
- Change default credentials on admin consoles, such as API managers and file managers.
- Patch or retire old systems, including legacy mail gateways and outdated CentOS hosts.
- Close anonymous FTP and lock down database features that run system commands.
- Expect high-volume, patient attack attempts that reflect machine persistence.
- Rotate admin API tokens and shared credentials, especially on platforms that host several brands.
- Avoid using language clues alone for attribution, since this operator faked them on purpose.
Overall, this AI-driven hacking campaign shows how one careless operator with cheap AI compute can reach national ministries in days.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
