# Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage Campaign

> Hunt.io identified a Chinese-speaking threat actor operating under the handle "Nie" (infrastructure family niestools.com) running a custom AI-agent orchestration framework, SecFlow, that interchangeably drives Claude, Qwen, and DeepSeek models through private proxy relays to automate reconnaissance, exploitation, and post-exploitation across government, education, and industrial targets in Taiwan, Indonesia, China, and Vietnam. The operator combined eight known n-day web vulnerabilities, ASPX/PHP/JSP webshells, the PNG-steganographic GLUTTON webshell framework, and a cross-platform C2 implant ("SecBox") to exfiltrate LSASS memory, registry hives, OA records, and AI-platform secrets, and is the second AI-orchestrated intrusion campaign Hunt.io has documented within roughly two months.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2325
- **ID:** TL-2026-2325
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Nie (China)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2014-6271, CVE-2020-1938, CVE-2022-22965, CVE-2016-4437, CVE-2021-43798, CVE-2024-4956, CVE-2021-29441, CVE-2021-44228

## Description

In a report published September 3, 2026, Hunt.io documented a Chinese-speaking threat actor operating the handle "Nie" who built a private AI-agent orchestration layer called SecFlow. SecFlow wraps Anthropic's Claude Agent Client Protocol (@agentclientprotocol/claude-agent-acp) and Alibaba's Qwen-Code runtime (@qwen-code/qwen-code) to let an operator swap between five model profiles -- claude-acp, deepseek-v4-pro, deepseek-v4-pro-anthropic, deepseek-v4-pro-official, and qwen-code -- without changing the task interface. Requests are routed through operator-controlled reverse proxies (claude.niestools.com, deepseek.niestools.com) rather than official vendor APIs, and a companion chatgpt.niestools.com endpoint exposed an open-source Sub2API gateway (Wei-Shaw/sub2api) used to pool and redistribute upstream LLM subscriptions. SecFlow's own configuration corpus (SKILL.md, references/vuln-types/*, references/reporting/*) encodes a full offensive workflow -- initialization, reconnaissance, exploitation, post-exploitation, and report generation -- covering file upload, command injection, template injection, SQL injection, Java deserialization, SSRF/cloud metadata, authentication bypass, and known-CVE playbooks.

Operationally, the actor chained eight n-day vulnerabilities -- Shellshock (CVE-2014-6271), Ghostcat (CVE-2020-1938), Spring4Shell (CVE-2022-22965), an Apache Shiro default-key deserialization flaw (CVE-2016-4437), a Grafana plugin path-traversal (CVE-2021-43798), a Sonatype Nexus Repository path-traversal (CVE-2024-4956), a Nacos AuthFilter bypass (CVE-2021-29441), and Log4Shell (CVE-2021-44228) -- along with a fake MySQL server (fakeserver_new.py) that returned malicious deserialization payloads to any Java client that connected to it, and Java class-based command-interpreter invocation, to obtain initial footholds. Confirmed victims include Taiwan's Kuomintang Party History Archives (via Shellshock against /gs32/kmt/index.htm), Indonesia's Ministry of Foreign Affairs (PHP webshells disguised as WordPress core/plugin files, AES-256-CBC-encrypted command channel), a Fengtai District, China government Office Automation (OA) environment, and industrial hosts in Da Nang, Vietnam.

The Fengtai OA intrusion illustrates the full kill chain: a FileManage upload handler allowed an ASPX webshell (cmd.aspx) to be planted; Windows discovery commands (whoami, hostname, tasklist, sc query) enumerated the host; ASPX-to-SQL bridges (sqldump.aspx, sql6.aspx) reached internal Oracle and MSSQL (via xp_cmdshell) tiers; ASPX implementations of Potato-style privilege-escalation techniques (potato.aspx/potato3.aspx/potato4.aspx/potato4r.aspx) abused Windows print, EFSRPC, and LSARPC token-coercion primitives with CreateProcessWithTokenW to reach SYSTEM; a pre-existing 75.8 MB LSASS dump found in an OA attachment store was split into 37 blocks and pulled out over an authenticated SOCKS5 relay via down.aspx (plain) and downx.aspx (XOR key 0xAA); extract.aspx then mined the dump for password-hash material alongside separately harvested SAM/SYSTEM registry hives; sqldump.aspx/sql6.aspx exfiltrated 822 OA user records and doc_helper.aspx/doc_view_666b2dde.aspx exfiltrated 949 attachments (~1.28 GB) of government and health records; the operator also inserted a new privileged OA account for durable access; and dl_e6.aspx/launchfw.aspx retrieved a second-stage implant (c22.exe, staged as fw.exe) from 158.247.234.124:18000 and launched it via Process.Start()/WMI Win32_Process.Create.

The recovered GLUTTON webshell framework hides executable bytecode inside PNG pixel data (row-major R/G/B channel bytes XORed against the 16-byte ASCII key "d0c41072a0dc784c" and terminated by a 0xFF 0x88 0x00 marker), generates JSPX/ASP.NET/SOAP/.NET-Core-Razor server-side loaders in raw, "confusion" (CDATA-obfuscated), and Unicode-JSPX variants, and exposes a Model Context Protocol (MCP) interface (glutton-mcp.md) offering full target management, file operations, shell execution, process control, database access, port-forwarding, and payload-generation tools. The separately recovered SecBox implant is a cross-platform (Windows/Linux) backdoor that impersonates a "System Configuration Utility" (internal name syscfg), communicates over TCP/TLS/WebSocket/KCP/QUIC multiplexed with Yamux, and resolves replacement C2 endpoints via a Dead Drop Resolver that decrypts AES-256-GCM blobs fetched from Pastebin/GitHub to yield comma-separated TCP, WebSocket, and TryCloudflare (trycloudflare.com) fallback routes -- letting the operator rotate infrastructure (129.211.184.149, 158.247.234.124:18000, 207.148.109.245:18000) without redeploying binaries. A separate compromise of an unauthenticated Chinese education-sector AI platform's management backend exposed 23 AI agent configurations, 14 API secret credentials (including Dify application keys and a Coze private key), internal service addresses, and 104 AI chatbot conversation logs containing structured student-profile data (names, student numbers, advisers, departments, grades, majors) -- and the same management endpoint accepted an unauthenticated configuration-write request, creating a supply-chain/tampering risk to the platform's production AI agents.

Attribution rests on the recovered handle "Nie," which appears in a SOCKS proxy credential (103.45.65.93:35888), in SecFlow's own agent-skill tasking metadata, in GLUTTON MCP binary build paths (C:\Users\nie\.cargo\..., /Users/nie/Project/glutton/...), and as the basis for the niestools.com domain family. Hunt.io consolidated five open directories sharing the same SOCKS endpoint, 120 cross-workspace file-content matches, reused SecFlow/GLUTTON artifacts and accounts, and a direct payload-hosting link between the fake-MySQL deserialization host and the second-stage implant host. This is the second AI-orchestrated intrusion campaign Hunt.io has documented in roughly two months, following a June 2026 campaign (discovered while pivoting on TencShell C2 infrastructure) that paired Claude Code with DeepSeek-v4-pro against government and financial-sector targets in Afghanistan, Thailand, and Taiwan, with reconnaissance of 5,890+ government hosts across ten countries.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1134 Access Token Manipulation
- T1027 Obfuscated Files or Information
- T1078 Valid Accounts
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1090 Proxy
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service

## Sources

- [Chinese hackers use AI agents in multi-country cyber campaign](https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html)
- [Chinese Operator Uses SecFlow to Route Claude, Qwen, and DeepSeek Across a Multi-Country Intrusion Campaign](https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia)
- [Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government and Financial Systems Across Four Countries](https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion)
- [AI Agent Drives Espionage Attack on Thai Ministry of Finance](https://www.darkreading.com/cyberattacks-data-breaches/ai-agent-espionage-attack-thai-ministry-finance)
- [Claude Code and DeepSeek Powered Chinese Cyber Espionage Campaign](https://securityaffairs.com/195474/ai/claude-code-and-deepseek-powered-chinese-cyber-espionage-campaign.html)
- [CA-26-026: Suspected Chinese State-Sponsored Intrusion Campaign Leveraging Split-Model Agentic AI Architectures](https://www.deepwatch.com/labs/ca-26-026-suspected-chinese-state-sponsored-intrusion-campaign-leveraging-split-model-agentic-ai-architectures/)
- [Sub2API — open-source LLM subscription/API-key pooling gateway referenced in operator infrastructure](https://github.com/Wei-Shaw/sub2api)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2325