On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems. The affected devices run specific versions of a large vendor's firewall software.
For security purposes, the vendor has been notified. The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.
The operation illustrates how an exposed management interface can become a path into an organization's identity infrastructure. For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible. The research below was conducted with proactive threat hunting using Dream's autonomous cyber research product, Hero.
Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain paired with the Fragnesia kernel privilege escalation, target lists, exploitation logs, and approximately 40 custom post-exploitation scripts. This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.
The discovered artifacts revealed an operation that began with exploit development in a lab environment and ended with persistent access to a US government organization's internal Active Directory domain. Dream researchers observed some evidence of AI-assisted tooling: Claude Code had been installed, an AI-powered offensive security platform called aiscan was configured with Chinese LLMs Deep Seek and Kimi API keys for the Chinese reconnaissance platform FOFA were present. While there is no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development.
Source: Hacker News · Summarized by HeadlinesBriefing