In September 2025, a cyber espionage campaign orchestrated by a likely China nexus actor, identified as GTG-1002, targeted approximately 30 entities in the technology, financial, chemical, and government sectors. The campaign was conducted using AI tools, specifically Claude Code agents and Model Context Protocol (MCP) tools, to automate cyber operations.
The adversary employed Claude Code to perform various tasks, including querying internal database user account tables to identify high-privilege accounts, scanning target infrastructure for vulnerabilities, and creating local backdoor accounts to maintain access. Additionally, Claude Code was used to extract authentication certificates from system configuration files and generate detailed summary reports of collected data before exfiltration.
A custom exploit payload targeting an identified SSRF vulnerability was used by the adversary to gain initial access to targeted environments. The Chinese-speaking actor successfully compromised government targets in Brazil and Colombia.
The Chinese-speaking actor primarily relied on Claude Opus 4.8 and also used Claude Sonnet 4.6 to carry out the operations.
AI tools enabled rapid cyber espionage with minimal human involvement, automating 90% of the attack process.