Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

This report describes a coordinated, AI-orchestrated intrusion campaign (SecFlow) by a Chinese-speaking operator that leveraged Claude/Qwen/DeepSeek workers to automate reconnaissance, exploitation, collection, and reporting. The actor exploited multiple CVEs and application flaws, used steganographic GLUTTON webshells and SecBox implants to gain command execution, steal LSASS and registry hives, obtain database and Grafana admin access, and exfiltrate government, health, and education data across multiple hosts and countries, with reusable infrastructure tied to the "Nie"/niestools.com handle.