During routine threat actor infrastructure hunting, I ( https://x.com/TheM3gatr0n/status/2112416302841393220 ) identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there. I published my initial findings. Then vulnonhq took it further. Grateful to vulnonhq for the credit in their report and for doing the hard work of proper evidence collection and victim notification. This is what collaborative research looks like. Routine infrastructure hunting surfaces things like this more often than people think. My report: http://them3gatron.github.io/ Vulnonhq obtained access to the server, pulled 16.4 GB of evidence including recovered deleted container layers, and mapped the full scope of the campaign. Their findings: 66 active intrusion projects. 48 reached some level of access. 6 reached root or SYSTEM level. The target list is what makes this significant. Vulnonhq identified: Vietnam Ministry of Defence and Ministry of Public Security. Taiwan Legislative Yuan. Indonesia State Intelligence Agency. India CDAC. Plus airlines, payments, and retail across Asia. 48 of 66 operations reached at least session-level access. Read Here: https://vulone.com/blog/a-china-linked-operator-used-ai-agents-to-attack-governments-across-asia submitted by /u/Strict-Ad3926
Originally posted by u/Strict-Ad3926 on r/ArtificialInteligence