AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI Coding Agents
AI-Agent-Driven Offensive Operation (TL-2026-2070), also tracked as DeadDropC2 Campaign, is a critical-severity tracked intrusion set, first published 2026-08-19. It is linked to a China-nexus actor with medium confidence, affects WordPress Foundation WordPress Core, references 2 CVEs (CVE-2026-63030, CVE-2026-60137), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1021.004), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-2070
- Threat ID
- TL-2026-2070
- Also known as
- DeadDropC2 Campaign, AI-Agent Crypto-Theft Operation, wp2shell Mass Exploitation Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-08-19
- Last reviewed
- 2026-08-19
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, blockchain, defi, gaming, finance, automotive
- Target regions
- Global, united states of america, germany, france, poland, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in AI-Agent-Driven Offensive Operation
Malware and tooling: DeadDropC2, xmrig, Claude Code, FOFA search engine, Hermes Agent, Monero miner, OpenAI Codex, ProjectDiscovery suite, Telegram C2 bridge, wp2shell
CloudSEK discovered an exposed open directory belonging to a Chinese-speaking threat operator who deploys autonomous AI coding agents (Claude Code, Codex, Hermes, pi agents) with safety approvals disabled to industrialize cyberattacks at scale. The operation comprises mass WordPress compromise via the wp2shell exploit chain (12,048 backdoor records across 8,996 sites), cryptocurrency wallet credential theft targeting hundreds of Solana addresses, cryptojacking via a deployed Monero miner, and data exfiltration from DePIN and blockchain platforms. The operator was developing DeadDropC2, an EtherHiding-style blockchain-based command-and-control system.
How AI-Agent-Driven Offensive Operation works
On August 19, 2026, CloudSEK's Global Threat Intelligence team published findings on a Chinese-speaking threat operator who has weaponized autonomous AI coding agents for large-scale cybercrime. The investigation began when CloudSEK discovered an unauthenticated Python http.server (SimpleHTTP/0.6 Python/3.11.15) listening on port 18080 of IP 80.96.109.64, with directory listing enabled, exposing the operator's entire home folder. CloudSEK researchers catalogued 21,442 directories and 142,262 files, mirroring everything for offline analysis. A sister host at 103.236.54.207 had an identical open-directory setup.
The operator's AI agent fleet consists of Claude Code (Anthropic) run with dangerously-skip-permissions flag enabled and attribution/discovery headers disabled, Codex (OpenAI) routed through a proxy (code.newcli.com) with disable_response_storage set, Hermes Agent (NousResearch open-source framework providing terminal access and Telegram C2 integration), and pi agents (open-source AI agents) — all operating in full-auto mode with safety approval prompts disabled globally across all agent profiles. The agents are tasked and monitored from a single Telegram account registered circa 2017, using a reusable Chinese-language jailbreak prompt that frames every job as an authorized penetration test. A self-hosted Zhipu GLM-5.2 proxy (via LiteLLM/llmio on port 7070) routes LLM traffic to reduce costs and evade provider abuse monitoring.
The operation spans two parallel campaigns. First, an internet-wide opportunistic campaign using an automated WordPress-to-webshell exploitation pipeline employing the wp2shell exploit chain targeting WordPress core (batch/v1 endpoint route-confusion and author__not_in SQL injection), creating unique w2s_<hex> backdoor administrator accounts on 8,996 WordPress sites (12,048 confirmed backdoor records). The operator also harvested 66 genuine database admin credentials directly from victim databases and built a 3.4-million-host reconnaissance corpus using the FOFA search engine. Additional exploitation attempts included a fastjson2 deserialization RCE sweep across 6,326 targets yielding no confirmed compromises, and a separate sweep of 3 hosts rated confirmed-high-risk for deserialization processing. A Monero miner was compiled on approximately July 13 and deployed onto worker hosts for cryptojacking.
Second, a targeted cryptocurrency and DeFi theft campaign involving approximately 34 confirmed breaches. The operator scraped approximately 326 Solana wallet addresses (142 with both private key and mnemonic) and 368 unique recovery seed/phrase captures (307 passphrase-field captures plus 236 keyphrase-field captures, ~454 unique addresses total) from a phishing clone network's misconfigured Firebase Firestore database that had zero security rules. The operator extracted Firebase config from clone site frontend JavaScript bundles and read every record via the public Firestore REST API with zero authentication. Separately, the operator executed at least two confirmed on-chain drain transactions against compromised trading bot wallets and stole real encrypted wallet private keys and balances from a trading bot backend via an authentication bypass. Data exfiltration from DePIN and blockchain platforms included 158,281 vehicle records from an unauthenticated GraphQL indexer, 2,250 user wallet addresses with derivation paths from a blockchain compute platform, an exposed 746 GB blockchain node data store containing a live root key in its genesis configuration, a full CMS dataset including unpublished entries and staff emails from a privacy-messaging network with on-chain token, and live withdrawal ledgers with victim names, bank details, and payout amounts from a real-money gaming/payments platform.
The operator developed a blockchain-based command-and-control system called DeadDropC2, an EtherHiding-style architecture implemented as a Solidity smart contract on the BNB Smart Chain testnet. Commands ride in transaction calldata emitted as events (not stored in contract storage), with implants polling via read-only view calls requiring no gas and leaving no on-chain trace. Commands are encrypted with AES-256-GCM with a key derived via PBKDF2-HMAC-SHA256 at 100,000 iterations from a shared secret and static salt, with the key never touching the blockchain. The command set includes shell execution, file download/update, exfiltration, sleep timing adjustment, beacon, and kill signals — though shell, download, update, and exfil are marked as simulation stubs with only sleep, beacon, and die being live. The system was never operationally deployed, only tested locally against a web3.py in-memory test EVM, with both recovered operator wallet addresses showing zero mainnet transactions.
Attribution is based on all operator notes in native Chinese (to-do lists, methodology documents, shell-history comments, agent tasking prompts), a weather query for a specific Chinese city in test chatter, a single long-lived Telegram account registered circa 2017, and the self-hosted Zhipu GLM-5.2 proxy — a Chinese LLM backend used to cut costs and avoid Western provider abuse monitoring. The 21,442-directory, 142,262-file open directory was exposed for an observation window of July 10 through July 28, 2026. By July 30, Shodan showed the sister host (103.236.54.207) as a Windows Server exposing SMB, RPC, NetBIOS, and WinRM with ports 18080 and 7070 closed.
MITRE ATT&CK techniques used in TL-2026-2070
Credential Access
T1003 OS Credential Dumping; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Lateral Movement
T1021.004 Remote Services: SSH
Defense Evasion
T1036 Masquerading; T1564 Hide Artifacts
Exfiltration
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1505.003 Server Software Component: Web Shell
collection
T1213 Data from Information Repositories
Impact
Command and Control
T1573.001 Encrypted Channel: Symmetric Cryptography
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning
defense-impairment
Affected products and versions in AI-Agent-Driven Offensive Operation
- WordPress Foundation — WordPress Core
Vulnerable versions: All versions prior to security patches for CVE-2026-63030 and CVE-2026-60137
Fixed in: All versions with CVE-2026-63030 batch/v1 route-confusion patch applied - Zhipu AI (Z.ai) — GLM-5.2
Vulnerable versions: All versions when deployed as an AI agent proxy backend without abuse monitoring - Anthropic — Claude Code
Vulnerable versions: All versions when used with --dangerously-skip-permissions and attribution/discovery header suppression - OpenAI — Codex
Vulnerable versions: All versions when proxy-routed with disable_response_storage=true and provider-side safeguards bypassed - NousResearch — Hermes Agent
Vulnerable versions: All versions — no built-in safety layer; requires external safety enforcement
Remediation for AI-Agent-Driven Offensive Operation
Patches
- Apply WordPress core patches for CVE-2026-63030 (route-confusion in REST API batch/v1 endpoint) and CVE-2026-60137 (SQL injection via author__not_in parameter)
- Apply fastjson2 deserialization patches if Java applications with Jackson/fastjson are in use
- Restrict or remove batch/v1 REST API endpoints on WordPress if not required for business operations
- Update AI coding agent configurations to enforce mandatory safety approval prompts; reject dangerously-skip-permissions usage
Immediate actions
- Block IPs 80.96.109.64, 103.236.54.207, 165.154.152.47, 165.154.157.40 at network perimeter
- Scan WordPress instances for unauthorized w2s_<hex> administrator accounts as primary indicator of compromise
- Search for webshell backdoors in wp-content/plugins/ and wp-content/uploads/ directories
- Audit WordPress core installations for CVE-2026-63030 (batch/v1 route-confusion) and CVE-2026-60137 (SQL injection), apply patches
- Check for Monero miner processes (renamed innocuous filename, hidden path) on all cloud infrastructure
- Audit all Firebase Firestore databases for public read/write security rules
- Rotate any API keys or credentials exposed in client-side JavaScript bundles (Helius, QuickNode, similar)
Workarounds
- Disable the WordPress REST API batch/v1 endpoint via .htaccess or reverse proxy rules if not actively used
- Enforce MFA on all WordPress administrator accounts; audit for unauthorized accounts daily
- Limit cross-host SSH key reuse; implement per-host key pairs and SSH certificate-based authentication
- Implement network segmentation so cloud databases and Firestore instances enforce authentication and network restrictions
- Monitor for ED25519 SSH key authentication from unknown public keys as a lateral movement indicator
- Review AI agent proxy logs for abnormal routing patterns or Chinese LLM endpoints in corporate environments
Longer-term hardening
- Deploy behavioral detection for rapid WordPress admin account creation as a webshell precursor signal
- Monitor for blockchain dead-drop C2 patterns: read-only polling of smart contract events at regular intervals
- Implement detection for Python http.server on non-standard ports as potential exfiltration staging signal
- Conduct continuous audits of cloud database security rules (Firestore, S3, RDS public access)
- Monitor for AI coding agent abuse telemetry including unsafe permission modes and attribution header disabling
- Track Telegram-based AI agent C2 bridging as an emerging threat vector
CVEs associated with AI-Agent-Driven Offensive Operation
Weaknesses (CWE) in AI-Agent-Driven Offensive Operation
CWE-306, CWE-89, CWE-287
Timeline of AI-Agent-Driven Offensive Operation
- Earliest recovered AI agent tasking sessions begin; first observed automated report generation and bulk targeting of cryptocurrency and DeFi platforms
- Heavy operational phase: dozens of targeted crypto/DeFi sweeps per day; operator builds recon corpus and launches wallet harvesting operations
- Monero miner compiled and built on operation infrastructure; binaries subsequently pushed to worker VPS hosts (165.154.152.47, 165.154.157.40)
- Mass WordPress exploitation pipeline ramps up using wp2shell exploit chain (CVE-2026-63030, CVE-2026-60137); peak wallet credential theft from trading bot ecosystems and open cloud databases
- Loot consolidation phase: wallet private keys, seed phrases, and mnemonic captures merged into combined datasets; sensitive data scan reports produced from DePIN/blockchain exfiltration
- Extracted data from DePIN and blockchain platforms processed: 158,281 vehicle records from GraphQL indexer, 2,250 wallet addresses, 746 GB blockchain node data, and gaming withdrawal ledgers with victim PII
- Monero miner deployed onto compromised hosts from worker VPS infrastructure; cryptojacking operation begins generating illicit mining revenue
- DeadDropC2 blockchain-based C2 system under active development: Solidity smart contract written, Python operator console and implant developed, tested against web3.py in-memory test EVM on BSC testnet
- Last shell history write recorded on primary staging host (80.96.109.64); WordPress monitoring continues; final operator console session
- Sister host 103.236.54.207 reimaged from open directory deployment to Windows Server (WIN-QGQL8EFDVAN) exposing SMB, RPC, NetBIOS, and WinRM; ports 18080 and 7070 closed
- CloudSEK publicly publishes findings detailing the entire operation including attacker infrastructure, TTPs, AI agent abuse methodology, WordPress exploitation, and crypto theft campaign
Sources cited for AI-Agent-Driven Offensive Operation
- AI-Agent-Driven Offensive Operation: Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign
- wp2shell Defenders Guide: Incident Response and Indicators of Compromise
- wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core
- wp2shell Critical Unauthenticated RCE Chain in WordPress Core — Centripetal Threat Research
- wp2shell in the Wild: Under 48 Hours from Patch to Mass Exploitation — ELLIO Technologies
- CloudSEK FortiBleed: Inside the FortiBleed Open Directory — Technical Analysis of Attacker Infrastructure
- CloudSEK Operation Escaneo: Infrastructure Exposure, TTP Analysis of Latin American Cyberattack Campaign
- Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework (EtherHiding C2) — Sekoia
Threats related to AI-Agent-Driven Offensive Operation
Detection coverage for TL-2026-2070
As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2070 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.