China-Linked AI Agent Campaign Hits Government Targets in Asia: Detection and Defense Guide

Hunt.io has documented a Chinese-speaking threat campaign that wires commercial AI models directly into live cyberespionage operations — the second separate China-linked operation the firm has identified doing so. This campaign targeted the Taiwan Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, and government and education systems across Asia, along with industrial sector organizations.

This is not speculative. It is confirmed, in-the-wild operational tradecraft: threat actors are no longer just using AI to write phishing lures. They are deploying autonomous and semi-autonomous AI agents as operational infrastructure — automating reconnaissance, target profiling, payload generation, and potentially command-and-control decision loops against real government targets.

If your organization operates in government, education, diplomatic, or industrial sectors — particularly with any Asia-Pacific footprint or relationship — you are in scope for this class of threat. Even organizations outside these verticals should pay attention: AI-agent-augmented intrusion tradecraft scales horizontally fast. What is being tested against foreign ministries today will be in commodity ransomware playbooks within 12-18 months.

Why This Matters to Defenders

Traditional nation-state tradecraft has a human speed limit. Operators sleep, make mistakes, reuse infrastructure, and generate detectable patterns at predictable cadence. AI agents remove several of those constraints:

• Reconnaissance at machine speed. An agent can enumerate external attack surface, parse leaked credential dumps, and profile target organizations continuously without operator fatigue.
• Adaptive phishing and social engineering. Agent-generated lures can be personalized per-target in near real time, incorporating current events, organizational structure, and communication style scraped from public sources.
• Rapid TTP rotation. When defenders publish indicators, agents can regenerate variants of tooling, scripts, and lure content faster than signature-based controls can be updated.
• Lower operator skill floor. Less-skilled operators can run sophisticated campaigns by delegating technical work to agent frameworks, expanding the pool of actors capable of sustained espionage.

The practical consequence: detection strategies that rely on static indicators of compromise (IOCs) alone will fail against this campaign class. Behavioral detection, egress monitoring, and identity-centric analytics become the primary line of defense.

Technical Analysis

Campaign Overview

Based on Hunt.io's reporting, the campaign exhibits the following characteristics:

No CVE is associated with this campaign in the public reporting — the threat is technique-driven, not vulnerability-driven. The abuse vector is the misuse of legitimate commercial AI services and agent frameworks as force multipliers for otherwise conventional intrusion activity: initial access via spearphishing or exposed services, followed by agent-assisted reconnaissance, lateral movement, and data collection.

How AI Agents Change the Observable Attack Chain

From a defender's perspective, the attack chain looks familiar at each individual step — the anomaly is in velocity, volume, and adaptation rate:

1. Initial access — Highly personalized spearphishing, often with agent-generated content that passes casual scrutiny and grammar-based detection. Attachments and links lead to credential harvesting or initial-stage loaders.
2. Post-compromise enumeration — Rapid, scripted enumeration of directories, mailboxes, document stores, and network shares. Agents can prioritize collection targets based on keyword analysis of stolen content in near real time.
3. LLM API egress — The signature behavior: compromised hosts or attacker-controlled infrastructure making sustained outbound connections to commercial AI API endpoints (e.g., api.openai.com, api.anthropic.com, api.deepseek.com, dashscope.aliyuncs.com, regional LLM providers) as part of the operational loop.
4. Collection and exfiltration — Archive staging, compression, and exfiltration over HTTPS, often to cloud storage or attacker-controlled VPS infrastructure.

Key Detection Opportunities

The agent-integration layer is the most defensible seam in this tradecraft:

• Outbound LLM API traffic from servers and workstations that have no business reason to use AI services. A domain controller, file server, or diplomatic archive system initiating TLS sessions to commercial LLM endpoints is a high-fidelity signal.
• High-frequency scripted enumeration — directory listing, mailbox access, and document retrieval at machine cadence rather than human cadence.
• Non-interactive logons performing bulk data access, particularly service accounts or compromised user accounts accessing volumes of data inconsistent with their historical baseline.
• Phishing attachments spawning script interpreters (powershell.exe, wscript.exe, mshta.exe, rundll32.exe) from Office processes — the initial access vector remains conventional.

Detection & Response

The following rules and queries target the observable behaviors in this campaign class. Tune thresholds to your environment — the LLM egress rule in particular requires you to first baseline which systems legitimately consume AI APIs.

SIGMA Rules

---
title: Suspicious Outbound Connection to Commercial LLM API Endpoint
id: 3f8a1c94-2b7d-4e5a-9c61-8d3e5f7a2b40
status: experimental
description: Detects network connections to commercial LLM API endpoints from processes that have no legitimate reason to consume AI services. China-linked campaigns documented by Hunt.io in 2025-2026 integrate commercial AI models directly into intrusion workflows, creating observable egress to AI provider infrastructure from compromised hosts.
references:
  - https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_destination:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'api.deepseek.com'
      - 'dashscope.aliyuncs.com'
      - 'open.bigmodel.cn'
      - 'api.moonshot.cn'
      - 'generativelanguage.googleapis.com'
  selection_suspicious_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\python.exe'
      - '\w3wp.exe'
      - '\sqlservr.exe'
  condition: selection_destination and selection_suspicious_process
falsepositives:
  - Developers legitimately testing LLM integrations from workstations
  - Approved internal AI tooling — baseline and allowlist authorized processes before enabling at high level
level: high
---
title: Office Application Spawning Script Interpreter - Phishing Initial Access
id: 91c2e7b5-4a1f-48d6-b83e-2f6c9a1d5e73
status: experimental
description: Detects Microsoft Office applications spawning script interpreters or command shells, consistent with agent-generated spearphishing attachments delivering initial-stage loaders as described in China-linked cyberespionage campaigns targeting Asian government entities.
references:
  - https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate macros in managed enterprise environments — investigate any hit in government/diplomatic contexts
level: high
---
title: Bulk Archive Staging via Compression Utility Before Exfiltration
id: c47d2a19-6e3b-4f81-a592-1b8d4e6c3a25
status: experimental
description: Detects command-line archive creation with password protection or multi-volume flags, a common staging behavior before exfiltration in espionage campaigns. Agent-augmented operations compress and stage collected documents at machine speed.
references:
  - https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
      - '\makecab.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
      - ' -v'
      - ' -r'
  condition: selection_img and selection_cli
falsepositives:
  - IT backup operations and software packaging — correlate with source system role and user baseline
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for endpoints initiating connections to commercial LLM API endpoints where the initiating process is a script interpreter, shell, or server process — the egress signature of agent-assisted operations. It joins process and network telemetry and surfaces rare process-to-LLM-destination pairs.

// Hunt: Suspicious process egress to commercial LLM API endpoints
// Relevant to China-linked AI-agent cyberespionage campaigns (Hunt.io, 2025-2026)
let llmDestinations = dynamic([
  "api.openai.com", "api.anthropic.com", "api.deepseek.com",
  "dashscope.aliyuncs.com", "open.bigmodel.cn", "api.moonshot.cn",
  "generativelanguage.googleapis.com", "api.cohere.ai", "api.mistral.ai"
]);
let suspiciousProcs = dynamic([
  "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "curl.exe", "python.exe", "python3.exe",
  "w3wp.exe", "sqlservr.exe", "regsvr32.exe"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (llmDestinations)
| where InitiatingProcessFileName in~ (suspiciousProcs)
| summarize
    ConnectionCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Devices = dcount(DeviceName),
    RemoteUrls = make_set(RemoteUrl),
    CommandLines = make_set(InitiatingProcessCommandLine)
    by InitiatingProcessFileName, DeviceName, AccountName
| order by ConnectionCount desc
// Secondary hunt: Office-spawned script interpreters (initial access vector)
;
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe")
| where FileName in~ ("powershell.exe","cmd.exe","wscript.exe","mshta.exe","rundll32.exe","certutil.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep a fleet for processes with active or recent network connections to LLM provider infrastructure — useful for rapid triage when you suspect an agent-assisted intrusion on a specific host or segment.

-- Artifact: Hunt for processes with network connections to LLM API endpoints
-- Context: China-linked AI-agent cyberespionage (Hunt.io reporting)
-- Resolves owning process for suspicious outbound connections

LET llm_ips <= SELECT RemoteIP, RemotePort, Pid, Status
FROM netstat()
WHERE RemoteIP =~ '.'
  AND Status =~ 'ESTAB'

SELECT
  n.Pid AS Pid,
  p.Name AS ProcessName,
  p.CommandLine AS CommandLine,
  p.Exe AS ExePath,
  p.Username AS Username,
  n.RemoteIP AS RemoteIP,
  n.RemotePort AS RemotePort,
  n.Status AS ConnStatus
FROM netstat() AS n
JOIN pslist() AS p ON n.Pid = p.Pid
WHERE n.Status =~ 'ESTAB'
  AND n.RemotePort IN (443, 8443)
  AND (
    p.Name =~ '(?i)powershell|pwsh|cmd|wscript|cscript|mshta|python|curl|w3wp'
    OR p.Exe =~ '(?i)temp|appdata|programdata|users\\public'
  )

Note: Velociraptor's netstat() returns IPs, not hostnames. Pair this hunt with DNS log review (or a follow-up lookup against the resolved IPs) to confirm whether connections land on LLM provider ASN ranges (e.g., Cloudflare-fronted API endpoints, Alibaba Cloud for DashScope, etc.).

Hardening Script — Egress Control Verification

The highest-value control against this campaign class is egress restriction: servers and standard user workstations should not be able to reach arbitrary internet destinations, including LLM APIs, without explicit authorization. This PowerShell script audits Windows hosts for outbound allow rules that are overly permissive and checks for LLM API reachability from the host.

# Security Arsenal - AI-Agent Egress Audit & Hardening Check
# Context: China-linked AI-agent cyberespionage campaigns (Hunt.io)
# Run elevated on servers and sensitive workstations

$Report = @()

# 1. Enumerate permissive outbound firewall rules (any/any allow)
$PermissiveRules = Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True |
    Where-Object { $_.Profile -match 'Domain|Private|Any' } |
    ForEach-Object {
        $addrFilter = $_ | Get-NetFirewallAddressFilter
        if ($addrFilter.RemoteAddress -eq 'Any') {
            [PSCustomObject]@{
                Check   = 'PermissiveOutboundRule'
                Item    = $_.DisplayName
                Detail  = "Allows outbound to ANY destination"
                Risk    = 'High'
            }
        }
    }
$Report += $PermissiveRules

# 2. Test reachability of commercial LLM API endpoints from this host
$LlmEndpoints = @(
    'api.openai.com','api.anthropic.com','api.deepseek.com',
    'dashscope.aliyuncs.com','open.bigmodel.cn','api.moonshot.cn'
)
foreach ($ep in $LlmEndpoints) {
    $reachable = Test-NetConnection -ComputerName $ep -Port 443 -WarningAction SilentlyContinue -InformationLevel Quiet
    if ($reachable) {
        $Report += [PSCustomObject]@{
            Check   = 'LLMEgressReachable'
            Item    = $ep
            Detail  = 'Host can reach LLM API over 443 - restrict if not business-approved'
            Risk    = 'Medium'
        }
    }
}

# 3. Check for recently executed script interpreters from user-writable paths
$SuspiciousPaths = @('\AppData\','\Temp\','\ProgramData\','\Users\Public\')
$Recent = Get-ChildItem 'C:\Windows\Prefetch' -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'POWERSHELL|CMD|WSCRIPT|MSHTA|PYTHON|CURL' -and
                   $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
foreach ($p in $Recent) {
    $Report += [PSCustomObject]@{
        Check   = 'RecentInterpreterExecution'
        Item    = $p.Name
        Detail  = "LastWrite: $($p.LastWriteTime) - validate against approved admin activity"
        Risk    = 'Info'
    }
}

# 4. Output
$Report | Format-Table -AutoSize
$Report | Export-Csv -Path ".\AI-Agent-Egress-Audit_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# RECOMMENDED HARDENING (review before applying):
# - Default-deny outbound on servers: allow only required destinations via proxy or firewall FQDN rules
# - Block LLM API FQDNs at the perimeter for host classes with no AI business case
# - Require authenticated proxy for all workstation egress; alert on direct-connect attempts

Remediation & Defensive Measures

Because this campaign is technique-driven rather than CVE-driven, remediation centers on architectural controls and behavioral detection, not patching:

1. Control AI Service Egress (Highest Priority)

• Inventory legitimate AI usage. Identify which teams and systems are authorized to consume commercial LLM APIs. Everything else is signal.
• Default-deny egress on servers. Domain controllers, file servers, mail servers, and database hosts should have no path to arbitrary internet destinations. Route required traffic through an authenticated proxy with FQDN allowlists.
• Block or alert on LLM API FQDNs at the perimeter for host classes without an AI business case. Maintain a current list of provider endpoints (OpenAI, Anthropic, DeepSeek, Alibaba DashScope, Zhipu, Moonshot, Google, Mistral, Cohere) — note that provider endpoints change, so subscribe to provider documentation and threat intel feeds.
• Alert on direct-connect bypass attempts from workstations that should traverse the proxy.

2. Harden Against Agent-Generated Phishing

• Assume lure quality is now high: grammar, personalization, and contextual awareness are no longer reliable phishing tells for end users.
• Enforce phishing-resistant MFA (FIDO2/passkeys) — agent-crafted credential harvesting pages defeat push-based and OTP MFA routinely.
• Detonate all attachments and rewrite/click-proxy URLs. Agent-generated payloads iterate fast; sandboxing with behavioral verdicts beats static AV.
• Deploy the Office-child-process Sigma rule above environment-wide; in government/diplomatic contexts, treat every hit as an incident until cleared.

3. Detect Machine-Cadence Behavior

• Baseline per-account data access volumes (mailbox reads, SharePoint/file share reads, directory queries). Alert on access volume and velocity anomalies — a compromised account being driven by an agent enumerates far faster than a human.
• Monitor for bulk archive staging (compression rule above) on file servers and workstations holding sensitive data.
• Watch for non-interactive or impossible-travel logon patterns preceding bulk access.

4. Intelligence-Driven Hunting

• Pull Hunt.io's published indicators for this campaign and the prior China-linked AI-agent campaign into your SIEM and block lists. Given the TTP rotation speed these actors demonstrate, treat IOCs as short-lived — re-hunt historical telemetry (30-90 days) when new indicators publish rather than only alerting forward.
• Map detections to MITRE ATT&CK: T1566 (Phishing), T1059 (Command and Scripting Interpreter), T1071.001 (Web Protocols), T1560.001 (Archive Collected Data), T1041 (Exfiltration Over C2 Channel).

5. For Asia-Pacific Government, Education, and Industrial Organizations

If you match the targeting profile of this campaign — diplomatic, political party, education, or industrial systems in the Asia-Pacific region — assume elevated priority in threat actor tasking:

• Conduct a compromise assessment against historical telemetry using the queries above rather than waiting for an alert.
• Review third-party and supply-chain access into your environment; these campaigns frequently pivot through trusted relationships.
• Engage national CERT resources and sector ISACs for indicator sharing on this specific campaign cluster.

The Bigger Picture

Two documented China-linked campaigns integrating commercial AI agents into live operations in a short window tells us this is now standardized tradecraft, not experimentation. The defensive implications are structural: static IOC programs depreciate faster, phishing awareness training built on "spot the bad grammar" is obsolete, and egress control — long treated as a nice-to-have — is now a primary detection surface.

The organizations that will fare well against agent-augmented adversaries are the ones that already know what their networks are supposed to look like: which hosts talk to which destinations, which accounts touch which data, and at what cadence. If you can't answer those questions today, that is the gap to close first.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub