Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Networks
Excerpt
The activity is separate from an earlier campaign involving Chinese-speaking operators, but shows a similar pattern: commercial AI models were used as operational tools during real intrusions. The actors targeted Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government systems in mainland China, and industrial organizations in Vietnam. Researchers linked five exposed attacker workspaces by tracing a shared SOCKS proxy endpoint . The…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 152.42.200.25 | High | Score 58/100 | First seen |
| IP | 81.70.240.170 | High | Score 58/100 | First seen |
| IP | 43.99.61.170 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…