Executive Summary
A sophisticated campaign by a suspected China-nexus threat actor has successfully compromised 25 servers globally, targeting the U.S., Japan, Taiwan, and South Korea. The operation is notable for its use of AI-assisted development tools, including Anthropic's Claude Code and AI-powered offensive platforms like 'aiscan' using DeepSeek and Kimi LLMs. The actor effectively weaponized a chain of PHP and Linux kernel vulnerabilities to gain root access to critical firewall management interfaces.
Technical analysis indicates the attackers bypassed traditional exploitation hurdles for the PHP2Shell vulnerability by developing custom, non-public exploit code tailored to specific firewall OS builds. Once root access was established, the actor moved laterally into internal networks, specifically targeting Active Directory environments to decrypt LDAP service accounts and perform large-scale password spraying.
This activity highlights a significant escalation in the use of LLMs to bridge the gap between theoretical proof-of-concept exploits and reliable, large-scale weaponization. The risk remains high as the attacker has reportedly fingerprinted over 19,000 potential targets with exposed management interfaces, posing a continued threat to government facilities and critical infrastructure providers.