BETWEEN 24 September and 14 October 2026, a suspected China-linked operator conducted 66 hacking operations from a single server using AI agents, according to VULONE Research. The campaign targeted government ministries in Vietnam, Taiwan, Indonesia, and India, alongside several private sector organisations including China Airlines, Air India, Juspay and Hertz.
The operator’s own records claim that 48 targets reached some level of access, with six projects reaching root or SYSTEM, 39 achieving command execution, and three obtaining a webshell. The operation used Cairn, an open‑source framework that drives AI agents, with a dispatcher feeding 116 short‑lived Kali Linux containers, each running an AI agent backed by a DeepSeek model. Over around 12 days, the system logged roughly 230,000 events, and a gateway key processed about 36.7 billion tokens.
The attack surface included public exploits, default passwords and older bugs, including a 2010 JBoss flaw, while data exfiltrated reportedly encompassed internal host details, database credentials, admin API tokens and source code. A notable detail was the operator’s insistence that every prompt and payload be in plain English, described as the “highest red line,” a linguistic constraint that could aid attribution signals but also mislead victims about the attacker’s language.
VULONE attributes the activity to one operator or a very small group, with Chinese language cues in script comments and task hints, and mentions Tencent‑operated AI services in financing, but cautions there is no evidence of state sponsorship. The report notes that victims have not publicly confirmed the claims, and that one session originated from a Kenyan mobile link.
In response, the article urges defenders to harden credentials (changing defaults on admin consoles and tokens), retire legacy systems, close anonymous FTP and restrict commands in database features, and rotate shared credentials, while warning against over‑reliance on language clues for attribution.