← threat actors
threat actor · not yet in the cluster map
china-linked
4 stories · 3 in the wild · August 4, 2026 – August 19, 2026
evidence: 3 observed · 1 claimed
how they got in
- ai agent 1 · Aug 4
- package registry 1 · Aug 4
sectors
- government 1 · Aug 19
- developers 1 · Aug 4
- security vendors 1 · Aug 4
geography
- china 3 · Aug 4
- taiwan 1 · Aug 19
techniques
- code execution 2 · Aug 4
- ai agent 1 · Aug 19
- lateral movement 1 · Aug 4
- proxyjacking 1 · Aug 4
attack phases seen
- Initial access 4 · Aug 19
- Execution 3 · Aug 19
- Lateral movement 1 · Aug 4
what we reported, newest first, grouped by story
August 19, 2026
- A China-linked operator used a complex AI framework to compromise government agencies, likely in Taiwan, in what Dark Reading characterizes as the first purported "near-autonomous" attack against a nation-state (Dark Reading). This extends the agentic-attack activity against Taiwanese energy and nuclear-safety targets reported last week (earlier coverage).
· Aug 19 · claimed · AI in Offensive Operations
Aug 1 – August 4, 2026 · 3 reports
- A China-linked actor weaponized a DeepSeek AI agent against a security firm. Researchers intercepted and analyzed the model as it attempted to compromise more than 1,200 hosts for proxyjacking to stage further attacks (Dark Reading) — a live example of the AI-as-operator pattern from earlier coverage.
· Aug 4 · observed · via ai agent · Threat Activity
- A Chinese-speaking actor is deploying GHOSTBLADE on iOS using the leaked DarkSword kit. Censys tracked 100+ web properties — mostly fake AWS sign-in pages — hosting the exploit chain (The Hacker News).
· Aug 4 · observed · Threat Activity
- 18 malicious npm packages deliver a cross-platform RAT to Alibaba tool users. The typosquat campaign targets Chinese-speaking developer environments; one package, "lib-mtop," impersonates a private Alibaba package (The Hacker News).
· Aug 4 · observed · via package registry · Threat Activity