Hackers Orchestrate Cyberattacks Using Commercial AI Models via SecFlow Framework
Cybercriminals are weaponizing large language models like Claude, Qwen, and DeepSeek through the SecFlow framework to automate and accelerate sophisticated cyberattacks against government and educational networks.
A new wave of cyberattacks is leveraging commercial artificial intelligence models, including Anthropic's Claude, China's Qwen, and DeepSeek, to automate and accelerate intrusion operations. Researchers from Hunt.io have identified a sophisticated campaign that utilizes a framework named SecFlow to orchestrate these AI agents, directing them to perform tasks such as reconnaissance, exploit testing, and data collection. This marks a significant evolution in cybercriminal tactics, where AI is not just a tool for generating malicious code but an integral part of the attack workflow, coordinating actions and maintaining context across multiple stages of an intrusion.
The campaign has targeted government and education networks across Asia, with confirmed breaches impacting Taiwan's Kuomintang Party History Archives, Indonesia's Ministry of Foreign Affairs, and various government and education networks in mainland China. One notable incident involved a Fengtai District government environment, where attackers successfully exfiltrated administrative and health records, stole Windows credentials, and deployed custom malware. The attackers combined AI-driven tasking with traditional cyberattack methods, including the exploitation of vulnerable public-facing servers, the use of stolen credentials, webshells, and custom remote-access malware.
The SecFlow framework plays a crucial role in this operation by breaking down broad objectives into smaller, manageable tasks assigned to specialized AI agents. Users can select different AI models, such as Claude, Qwen, or DeepSeek, without altering the task interface, allowing the system to efficiently distribute work. SecFlow then connects these AI workers to target details, storage, proxy routes, and necessary tool permissions. The setup even included private model relays alongside official provider routes, enabling a seamless flow of information and results between different stages of the attack.
Despite the advanced use of AI for coordination and speed, the underlying attack vectors remain conventional. The campaign relied on familiar techniques like exploiting vulnerable applications, credential testing, and deploying custom implants like SecBox, a Go-based remote-access tool. While AI significantly amplifies the operational speed and coordination capabilities of threat actors, it can also propagate errors quickly throughout the workflow if an initial mistake is made. This highlights that AI enhances efficiency but does not fundamentally change the nature of the vulnerabilities being exploited.
The Fengtai District intrusion, for instance, began with an exploited Office Automation application that accepted uploaded ASPX files. Attackers used server-side command pages to execute Windows commands, map internal systems, attempt privilege escalation, and exfiltrate data. They also deployed the SecBox implant, which provided remote access, file transfer capabilities, port scanning, and traffic proxying. This blend of webshell access and endpoint tools underscores the need for continuous web server monitoring beyond initial exploit alerts.
In another instance, an exposed education AI management service inadvertently disclosed agent settings, secrets, conversations, and student profile data. Researchers confirmed the use of leaked credentials against a production API and an unauthenticated request to create an agent configuration, though a full server takeover was not confirmed. This distinction is critical for accurate impact assessment.
The campaign also tested various known vulnerabilities, including Apache Shiro, Shellshock, Spring4Shell, Ghostcat, Log4Shell, Grafana, Nexus, Nacos, and others. While a claimed Apache Shiro success was not fully substantiated by evidence, it was incorporated into subsequent instructions, leading to numerous unsuccessful follow-up tests. This demonstrates how AI coordination can multiply an operator's speed but also risks spreading early errors across the entire attack chain.
Organizations are urged to bolster their defenses by promptly patching internet-facing software, removing exposed directories, restricting administrative interfaces, rotating compromised credentials, and diligently inspecting web servers for unexpected loaders. Furthermore, monitoring for unusual outbound connections, reviewing authentication and application logs, and validating automated security findings are crucial steps. The increasing sophistication of AI-driven attacks necessitates behavior-based detection methods, network segmentation, and the principle of least privilege to limit potential damage.