kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · IR

Cleaver

also tracked as alibaba 2, deepseek 1, minimax 1, moonshot ai 1, stepfun 1, z ai 1

2 stories · 1 in the wild · June 25, 2026 – September 9, 2026

evidence: 1 observed · 1 claimed

sectors

  • ai labs 2 · Sep 9

geography

  • china 2 · Sep 9

techniques

  • data exfiltration 1 · Sep 9
  • model extraction 1 · Jun 25

attack phases seen

  • Collection 2 · Sep 9
  • Exfiltration 1 · Sep 9

what we reported, newest first, grouped by story

September 9, 2026

  • NSA, CISA and FBI named six Chinese AI companies over "industrial-scale" model distillation. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok since at least late 2024, routed through native APIs, cloud providers, third-party aggregators and gray-market "transfer station" proxies to evade geo-restrictions and traceability. Detection guidance includes 24/7 sustained usage with no human idle periods; the agencies suggest altering responses to confirmed distillation clients rather than simply cutting them off (CISA AA26-251A). · Sep 9 · observed · as deepseek, moonshot ai, alibaba, minimax, stepfun, z ai · AI & Model Security

June 25, 2026

  • Anthropic alleges Alibaba illicitly extracted capabilities from Claude, raising the prospect of model-distillation/IP-theft as a recurring dispute between frontier labs. Reuters · Jun 25 · claimed · as alibaba · AI & Model Security