# China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models

> NSA, CISA, and FBI jointly warn that six China-based AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are conducting coordinated, state-adjacent industrial-scale model distillation campaigns against U.S. frontier AI providers (Anthropic, OpenAI, Google DeepMind, xAI) since at least late 2024, using gray-market proxy infrastructure, fraudulent accounts, and automated routing to extract billions of tokens of proprietary capabilities for competing model training.

- **Published:** 2026-09-09T00:00:00Z
- **Last reviewed:** 2026-09-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2413
- **ID:** TL-2026-2413
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** China AI Distillation Campaign (China)
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 8, 2026, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) jointly released Cybersecurity Advisory AA26-251A, revealing that six China-based artificial intelligence companies have been conducting coordinated, industrial-scale malicious knowledge distillation campaigns against U.S. frontier AI model providers since at least late 2024, likely with Chinese government awareness. The advisory represents the most comprehensive U.S. government attribution of AI model intellectual property theft to date, co-signed by three agencies at the highest level of interagency coordination.

The campaign targets four major U.S. AI model families: Anthropic's Claude variants (including Claude 3.7, Sonnet 4, Sonnet 4.5, Opus 4.1, Opus 4.5, Opus 4.8, Sonnet 4.5 Thinking, Fable 5, Haiku 4.5, and Claude Code), OpenAI's GPT series (GPT-3 through GPT-5.5, including GPT-4o, GPT-4 Mini/Nano, GPT-5 Pro/Codex/Mini, GPT-5.1/5.2, and GPT-5.5), Google DeepMind's Gemini models (Gemini 1, 2, 2.5 Pro/Flash, and Gemini 3 Pro), and xAI's Grok models (Grok 3 Mini, Grok 4, Grok Code Fast-1). Six Chinese entities each targeted specific capabilities for their own competing models: DeepSeek extracted reasoning, optimization, and censorship-safe training data for R1 and V3; Moonshot AI extracted Claude Fable 5 and GPT-4o outputs for Kimi-K3 and Kimi-K2 (Anthropic detected over 3.4 million exchanges); Alibaba targeted software engineering, customer service dialogue, and image/character creation for Qwen; MiniMax extracted CoT reasoning, RL, SFT, and software engineering for M2 and attempted prompt injections against Claude Code; StepFun targeted coding and agentic functions for Step 4; and Z.AI extracted billions of tokens of GPT-5.5 and Claude Opus 4.8 data for CoT reasoning development. Anthropic alone detected over 16 million exchanges from approximately 24,000 fraudulent accounts.

The attack infrastructure relies on a sophisticated multi-layer evasion ecosystem. At the core are gray-market API proxies known as 'transfer stations'—overseas servers that forward API requests from within China, bypassing geographic restrictions and accepting payment in RMB via WeChat or Alipay at 70-90% below official pricing. An estimated 73,000 servers participate in this ecosystem, running open-source proxy tooling (xray, sing-box, VLESS, Shadowsocks) and model routing software (sub2api). The CISPA Helmholtz Center for Information Security found that 45.8% of these proxy services silently substituted requested models with cheaper or open-source alternatives—one 'GPT-5' endpoint was powered by GLM-4-9B, achieving only 37% of expected MedQA benchmark performance. Proxy operators monetize through three revenue streams: markup on access (credit farming, subscription carving, fraud), model swapping and token inflation (delivering cheaper models than advertised), and log harvesting as the primary product—every prompt and response passing through a transfer station is captured as a distillation dataset.

The advisory identifies four novel TTPs not yet catalogued in MITRE ATLAS: (1) regional restriction evasion and subscription exploitation, including bulk procurement of enterprise accounts shared across developer teams with tiered budget management; (2) centralized request routing infrastructure providing model/provider abstraction, real-time health monitoring, centralized quota enforcement, automated sanitization, and automated failover between pathways during blocking attempts; (3) automated request metadata sanitization at the infrastructure layer, systematically stripping organizational identifiers; and (4) systematic quota and cost optimization, including pathway selection prioritizing cost-efficiency and cache optimization versus task diversity balancing. Additionally, entities used chain-of-thought reasoning extraction via prompts instructing models to articulate internal reasoning, direct and indirect prompt injection (AML.T0051), and jailbreak techniques (AML.T0054). MiniMax demonstrated aggressive adaptation by pivoting nearly half its traffic to newly released Claude models within 24 hours of availability. DeepSeek employed synchronized traffic across accounts with shared payment methods for load balancing and generated censorship-safe alternatives to politically sensitive queries.

The advisory recommends three immediate actions: comprehensive detection and mitigation using behavioral monitoring systems, classifiers, and fingerprinting techniques to identify anomalous API usage patterns (24/7 sustained throughput without human variation, immediate maximum subscription utilization, consistent quota exhaustion); deployment of targeted response changes including differential privacy noise injection and downgraded model responses for high-confidence malicious distillation requests without informing suspected distillers; and establishment of cross-organization intelligence sharing across model providers, cloud platforms, and API aggregators to correlate distributed campaign activity. The U.S. government assesses that models built through illicit distillation are unlikely to retain safety safeguards, creating downstream risks around bioweapons development, malicious cyber activities, and erosion of U.S. technological leadership in artificial intelligence.

## MITRE ATT&CK

- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1078 Valid Accounts
- T1036 Masquerading
- T1090.003 Multi-hop Proxy
- T1572 Protocol Tunneling
- T1119 Automated Collection
- T1048 Exfiltration Over Alternative Protocol
- T1583 Acquire Infrastructure
- AML.T0008 Acquire Infrastructure
- AML.T0040 AI Model Inference API Access
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak
- AML.T0042 Verify Attack
- AML.T0024 Exfiltration via AI Inference API
- AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
- AML.T0048 External Harms

## Sources

- [CISA Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a)
- [SecurityWeek: US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities](https://www.securityweek.com/us-agencies-warn-china-is-systematically-extracting-frontier-ai-capabilities/)
- [Anthropic Blog: Detecting and Preventing Distillation Attacks](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks)
- [Bloomberg: US Says Alibaba, DeepSeek Have Systematically Siphoned AI Models](https://www.bloomberg.com/news/articles/2026-09-09/us-says-alibaba-deepseek-have-systematically-siphoned-ai-models)
- [Chinatalk Media: How to Buy Cheap Claude Tokens in China—The Transfer Station Economy](https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens-in)
- [Infrawatch: 73,000 Servers Selling Western Frontier AI Into China—Transfer Stations](https://infrawatch.com/blog/73000-servers-selling-western-frontier-ai-into-china-transfer-stations)
- [CISPA: Real Money, Fake Models (arXiv 2603.01919)](https://arxiv.org/abs/2603.01919)
- [Tom's Hardware: Chinese Grey Market Sells Claude API Access at 90% Off Through Proxy Networks](https://www.tomshardware.com/tech-industry/artificial-intelligence/chinese-grey-market-sells-claude-api-access-at-90-percent-off-through-proxy-networks-that-harvest-user-data)
- [TechCrunch: Anthropic accuses Chinese AI labs of mining Claude as US debates AI chip exports](https://techcrunch.com/2026/02/23/anthropic-accuses-chinese-ai-labs-of-mining-claude/)
- [OpenAI Letter to U.S. House Select Committee on Strategic Competition (Feb 12, 2026)](https://openai.com/blog/openai-warns-house-select-committee-on-chinese-ai-distillation)
- [Google Threat Intelligence Blog: Distillation Attacks Against Gemini Models](https://blog.google/threat-analysis/gemini-distillation-attacks-2026/)
- [MITRE ATLAS: AML.T0024.002 - Extract AI Model via Exfiltration via AI Inference API](https://atlas.mitre.org/techniques/AML.T0024.002)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2413