Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
3 IOCs

Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Networks

Cyber Press
Cyber Press
Published September 4, 2026Original Report

Excerpt

The activity is separate from an earlier campaign involving Chinese-speaking operators, but shows a similar pattern: commercial AI models were used as operational tools during real intrusions. The actors targeted Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government systems in mainland China, and industrial organizations in Vietnam. Researchers linked five exposed attacker workspaces by tracing a shared SOCKS proxy endpoint . The…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTURE152.42.200.2581.70.240.17043.99.61.170CAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(3)
Capability
Victim

Indicators of Compromise

Open the mindmap →

3 indicators

TypeIndicatorConfidenceScoreFirst Seen
IP152.42.200.25HighScore 58/100First seen
IP81.70.240.170HighScore 58/100First seen
IP43.99.61.170HighScore 58/100First seen

IOC Relationship Graph

Building graph…