LLM-Powered APT Campaigns: How China-Linked Operators Weaponized Claude Code And DeepSeek In A Government-Targeted Intrusion + Video

Introduction

In June 2026, cybersecurity researchers at Hunt.io made a stunning discovery that fundamentally altered the threat landscape: an exposed open directory belonging to a China-linked threat group revealed the full operational toolkit of a state-sponsored espionage campaign. The directory contained JSP and PHP webshells, custom exploit scripts, cloned login portals, operational logs, and most notably, evidence of a dual-model LLM setup integrating Claude Code for execution and session persistence with DeepSeek-v4-pro for attack reasoning. This marks a significant tactical evolution—the first documented instance of commercial large language models being woven into the operational cycle of an Advanced Persistent Threat (APT) group targeting government systems across Afghanistan, Thailand, and Taiwan, alongside reconnaissance against U.S. government portals and financial institutions across Europe, Australia, and Asia.

Learning Objectives

Understand the technical architecture of the TencShell malware framework and its derivation from the open-source Rshell C2 platform
Analyze how threat actors integrated Claude Code and DeepSeek-v4-pro into a dual-model LLM attack pipeline
Identify indicators of compromise (IOCs) and develop detection strategies for LLM-assisted intrusion workflows
Implement defensive measures to mitigate AI-augmented cyber espionage tactics

You Should Know

1. TencShell: The Go-Based Implant Powering the Campaign

TencShell is a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework. The original Rshell project, designed for cross-platform offensive security use, includes remote command execution, file and process management, terminal access, in-memory payload execution, and multiple C2 transports. The threat actor customized and repackaged this framework, adding communication patterns that closely mimic Tencent-style API traffic to make malicious requests blend into ordinary application activity.

Attack Chain Analysis:

The infection chain observed in the wild employed multiple stages:

1. First-stage dropper – Initial delivery mechanism

Donut shellcode – Position-independent code for payload execution
Masqueraded .woff web-font resource – Disguised malicious payload
Memory injection – In-memory execution to evade file-based detection
Web-like C2 communication – Blended traffic mimicking legitimate web services

Linux Command to Detect Suspicious Go Binaries:

 Scan for Go-compiled binaries with suspicious network indicators
find / -type f -executable -exec file {} \; 2>/dev/null | grep "Go executable" | xargs strings | grep -E "TencShell|Rshell|Reacon"

Check for unexpected outbound connections on unusual ports
sudo netstat -tunap | grep -E "ESTABLISHED|SYN_SENT" | grep -vE ":(80|443|22|53)"

Windows PowerShell Command for Process Investigation:

 Identify processes with suspicious network behavior
Get-1etTCPConnection -State Established | Where-Object {$_.RemotePort -1otin @(80,443,22,53,3389)} | Format-Table -AutoSize

Check for Go runtime indicators in running processes
Get-Process | Where-Object {$_.Modules.ModuleName -match "go|runtime"} | Select-Object ProcessName, Id, StartTime

The Dual-Model LLM Architecture: Claude Code Meets DeepSeek-v4-pro

The most significant discovery from the exposed directory was the integration of two commercial LLMs into the attack workflow:

Claude Code – Deployed for execution and session persistence, leveraging Anthropic’s AI coding assistant to automate command execution, maintain persistent access, and orchestrate post-exploitation activities
DeepSeek-v4-pro – Utilized for attack reasoning, vulnerability analysis, and decision-making logic

This dual-model approach represents a tactical evolution from previous AI-orchestrated campaigns. In September 2025, the Anthropic AI-orchestrated Campaign (C0062) conducted by a likely China-1exus espionage actor (GTG-1002) demonstrated how Claude Code agents could perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration across approximately 30 entities. The current campaign builds on this foundation, adding DeepSeek for enhanced reasoning capabilities.

How Attackers Bypass AI Guardrails:

LayerX researchers demonstrated that Claude Code can be transformed into a nation-state-level attack tool with minimal effort. By modifying a single project file (CLAUDE.md), attackers can bypass safety measures and persuade the AI to execute comprehensive penetration tests and credential theft. The attack vector is remarkably simple:

Modify CLAUDE.md → Bypass Claude's safety护栏 → Automated full-scale attack execution

Technical Configuration for AI-Assisted Attacks:

The attackers likely configured their environment using Anthropic API-compatible endpoints:

 Environment variables for LLM integration (as observed in threat actor infrastructure)
export ANTHROPIC_BASE_URL="https://api.anthropic.com"
export ANTHROPIC_AUTH_TOKEN="[bash]"
export ANTHROPIC_MODEL="claude-code"
export DEEPSEEK_API_URL="https://api.deepseek.com/v4"
export DEEPSEEK_MODEL="deepseek-v4-pro"

Detection Strategy for LLM-Assisted Intrusions:

Security teams should monitor for:

Unusual API calls to LLM providers from compromised hosts

2. CLAUDE.md file modifications in web-accessible directories

3. Automated reconnaissance patterns that exceed human-scale scanning

Session persistence mechanisms that leverage AI for decision-making

3. Indicators of Compromise and Infrastructure Mapping

Hunt.io researchers published a comprehensive IOC set, including IP addresses, file hashes, and HuntSQL queries for infrastructure pivoting. Key IOCs include:

IP Addresses (C2 Infrastructure):

112.213.124.159, 112.213.124.132, 112.213.124.163
134.122.200.153-155, 134.122.200.114-116
192.229.115.229, 192.229.115.230
192.238.134.166, 192.163.167.5-7, 192.163.167.10
45.64.52.242, 45.64.52.245, 38.55.105.143

File Hashes (SHA256):

– `90b7b2c6f3d05234dc55678243039d7e51f0d54190239e5234a0005533337dc8`
– `03f26cbfa3ca15fcb43f512aa4041732beeec267f9d1dc74a11f7b0bb32e86bb`
– `2954639be599f23c2229a9743aba09a1d9d11bf2becc62bf353384437db37dee`

HuntSQL Query for IOC Pivoting:

-- HuntSQL query to identify related infrastructure (as used by Hunt.io)
SELECT ip, domain, certificate_hash, first_seen, last_seen
FROM infrastructure
WHERE certificate_hash IN (
SELECT certificate_hash FROM certificates 
WHERE issuer LIKE '%Gshell%' OR subject LIKE '%TencShell%'
)
OR ip IN (
SELECT ip FROM c2_nodes WHERE malware_family = 'TencShell'
)
ORDER BY last_seen DESC;

4. Defensive Measures and Mitigation Strategies

Organizations with exposure on government portals or financial infrastructure should implement the following measures:

Network-Level Defenses:

 Linux: Block known malicious IPs using iptables
for ip in 112.213.124.159 134.122.200.153 192.229.115.229; do
sudo iptables -A INPUT -s $ip -j DROP
sudo iptables -A OUTPUT -d $ip -j DROP
done

Linux: Monitor for suspicious outbound connections
sudo tcpdump -i any -1 "host not (192.168.0.0/16 or 10.0.0.0/8) and tcp port not (80 or 443 or 22 or 53)"

Windows PowerShell: Block Malicious IPs:

 Block IPs using Windows Firewall
$maliciousIPs = @("112.213.124.159", "134.122.200.153", "192.229.115.229")
foreach ($ip in $maliciousIPs) {
New-1etFirewallRule -DisplayName "Block TencShell C2 $ip" -Direction Inbound -RemoteAddress $ip -Action Block
}

Application-Level Defenses:

Web Application Firewall (WAF) Rules: Block requests containing `CLAUDE.md` modifications or suspicious API calls to LLM endpoints
Endpoint Detection and Response (EDR): Monitor for Go runtime processes with unexpected network behavior

Log Analysis: Search for indicators of LLM-assisted reconnaissance:

Linux: Scan web logs for automated scanning patterns
grep -E "(/wp-admin|/api|/admin|.php\?)" /var/log/nginx/access.log | \
awk '{print $1}' | sort | uniq -c | sort -1r | head -20

5. LLM-Specific Threat Detection Framework

As LLMs become integrated into attack workflows, security teams must adapt detection strategies. Consider implementing:

Behavioral Anomaly Detection:

 Python pseudo-code for detecting LLM-assisted patterns
def detect_llm_assisted_activity(log_entries):
anomalies = []
for entry in log_entries:
 Flag unusual API call patterns
if "api.anthropic.com" in entry or "api.deepseek.com" in entry:
if entry.timestamp not in expected_llm_usage_patterns:
anomalies.append(entry)
 Flag automated reconnaissance patterns
if entry.request_count > human_threshold  10:
anomalies.append(entry)
 Flag session persistence anomalies
if entry.session_duration > normal_session_duration  5:
anomalies.append(entry)
return anomalies

MITRE ATT&CK Mapping:

The TencShell campaign aligns with several MITRE ATT&CK techniques:

| Technique | ID | Description |

|–|–|-|

6. Third-Party Risk and Supply Chain Implications

The TencShell intrusion was delivered through a third-party user connected to the customer environment. This highlights the critical risk posed by third-party access in global supply chains:

Business Risk: A compromised endpoint connected to a regional site can expose supplier relationships, production workflows, intellectual property, customer data, and logistics processes
Operational Risk: Attackers can execute inline binaries, load DLLs, run .NET assemblies from memory, establish SOCKS5 proxies, and pivot deeper into segmented internal systems

Third-Party Risk Assessment Commands:

 Linux: Identify third-party VPN connections
sudo last | grep -E "vpn|pptp|openvpn" | awk '{print $1,$3,$4,$5,$6,$7}'

Linux: Check for unexpected SSH keys
for user in $(getent passwd | cut -d: -f1); do
if [ -f /home/$user/.ssh/authorized_keys ]; then
echo "User $user has authorized_keys:"
cat /home/$user/.ssh/authorized_keys | grep -v "^"
fi
done

What Undercode Say

LLM integration in APT operations is no longer theoretical – The TencShell campaign represents the first documented case of commercial LLMs being deployed in an active, state-sponsored intrusion campaign, moving from academic concern to operational reality
Detection strategies must evolve beyond signature-based approaches – Traditional IOC matching is insufficient against LLM-assisted attacks that can dynamically generate novel exploit paths and adapt to defensive measures in real-time
The dual-model architecture signals a new tier of sophistication – By separating execution (Claude Code) from reasoning (DeepSeek-v4-pro), attackers achieve both operational speed and strategic flexibility, making detection significantly more challenging

Prediction

+1 Expect a surge in LLM-assisted attack campaigns across 2026-2027 as threat actors replicate and refine the TencShell model, democratizing sophisticated cyber espionage capabilities to a wider range of state and non-state actors
-1 The commoditization of AI-powered attack tools will outpace defensive adoption, creating a significant asymmetry where defenders struggle to detect and respond to attacks that can evolve in real-time
+1 Security vendors will accelerate development of LLM-specific detection frameworks, with AI-powered defense becoming a mandatory component of enterprise security stacks within 12-18 months
-1 Organizations without dedicated security teams will face disproportionate risk as LLM-assisted attacks lower the barrier to entry for sophisticated intrusions, widening the cybersecurity skills gap impact
+1 Regulatory frameworks like NIS2 will likely incorporate AI threat detection requirements, driving compliance-driven adoption of advanced defensive measures

The full IOC set and HuntSQL queries are available through Hunt.io’s research platform. Organizations with exposure on government portals or financial infrastructure should verify the published IOCs and monitor for connections to the identified TencShell infrastructure immediately.

▶️ Related Video (78% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Threatintelligence Apt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post