Skip to content
badbots.news
MisuseSerious1 sourceFirst seen
Picture from the thehackernews.com article
Image: thehackernews.com

AI-Assisted Hackers Rooted 25 Firewalls, Including Three at a U.S. Government-Affiliated Network

Ourtake

Artifacts suggest the attacker used Claude Code and LLMs from DeepSeek and Kimi to help build a custom exploit chain.

What happened

Cybersecurity firm Dream reported an apparently AI-assisted campaign by a suspected China-nexus actor that combined PHP2Shell and Fragnesia exploits to root 25 firewall servers in the U.S., Japan, Taiwan and South Korea. Three systems belonged to a U.S. government-affiliated environment, and the attacker tried to reach Active Directory. Artifacts pointed to Claude Code and LLMs from DeepSeek and Kimi; the full extent of the compromise remains unclear.

Source