Which group is behind SecFlow and GLUTTON?

Nobody has named one. Hunt.io describes a Chinese-speaking operator and ties the infrastructure together through a shared SOCKS proxy and a recurring handle, 'Nie', found in build paths and proxy credentials. Its report does not name a real-world actor or state a confidence level, so treat attribution as unresolved.

Did the AI models hack the victims on their own?

No. According to Security Affairs' summary of the research, the models did not break in by themselves. The operator built the orchestration that connected model capabilities to conventional intrusion steps. Hunt.io's own conclusion credits exposed services, unpatched applications, stolen credentials and ordinary post-exploitation tooling.

How can defenders spot this kind of activity?

Look for the conventional signals first: Java deserialization and CAS exploitation attempts, new webshells, LSASS access and unexpected privileged accounts. Then add a layer for agent behaviour, such as sustained calls to model APIs or relays from hosts that have no reason to make them. That second layer is our recommendation, not something Hunt.io prescribes.

Are the indicators public?

Yes. Hunt.io lists IP addresses, the niestools[.]com relay domain, hashes and the GLUTTON XOR key in its report. We reproduce only a small defanged subset here. Pull the full list from the primary source before blocking anything.

SecFlow: Operator Ran Claude, Qwen and…

A Chinese-speaking operator built an agent framework that could drive Claude, Qwen or DeepSeek through the same intrusion playbook, then left five open directories exposed on the internet. Hunt.io used them to rebuild the whole setup. In our view it is one of the more complete looks yet at what an AI-driven intrusion crew actually runs day to day, including where it fails.

Hunt.io published on September 3, 2026, after first disclosing under TLP:AMBER to national CERTs. Security Affairs covered it on September 4. Hunt.io describes this as a second, separate campaign from its earlier Claude Code and DeepSeek research.

The Framework: SecFlow

SecFlow splits an objective into tasks and hands them to specialist workers for reconnaissance, exploitation, collection and reporting. Workers share storage, target configuration and proxy routing. Hunt.io found five model profiles, spread across Claude, Qwen Code and DeepSeek. Several ran in permissive modes: bypassPermissions for the Claude-style profiles and yolo approval mode for others. Two profiles reached DeepSeek through a relay under the niestools[.]com domain instead of the official API.

A skill file drove the phases (initialisation, reconnaissance, exploitation, post-exploitation, reporting) and routed each candidate to vulnerability-specific playbooks. Because the task interface stayed constant, the operator could change models without changing the workflow. That is the part defenders should note. In our assessment, blocking one provider would not stop an operation built this way.

The Toolkit: GLUTTON

GLUTTON generates webshells for Java, .NET Framework, .NET Core and Node.js, in forms including JSP, JSPX, ASPX and SOAP. Payloads are XOR-encrypted and hidden in the RGB channels of PNG images, then carried over PNG, form, JSON or XML traffic. Hunt.io reports the same 16-byte ASCII key in every recovered variant: d0c41072a0dc784c. The loader XORs the pixel stream with the repeating key and scans backward for the terminator bytes FF 88 00. Java variants use a fresh class loader. .NET variants use Assembly.Load.

A reused key across all samples is a gift to detection engineers. It is also a reminder that the model-driven part of this campaign sat on top of fairly ordinary tradecraft. GLUTTON also exposes target, file, command, process, database, port-forwarding and payload methods to Claude over MCP.

What They Reached

Hunt.io confirmed a breach of a Fengtai District government office automation environment in China. Activity included command execution, an LSASS dump of about 75.8 MB retrieved in 37 blocks, SAM and SYSTEM hives, 822 account records, a new OA account with elevated application privileges and 949 attachments totalling about 1.28 GB in the OA inventory. Hunt.io lists a related public-health application among the systems targeted, and its recovered material included selected health-related documents, among them a chronic-disease report containing patient information.

It also documented access to a Chinese education AI platform: 23 agent configurations, 14 populated secret fields and 104 complete dialogue records, some containing student data. The report mentions root database and Grafana admin access on a university campus-card system but gives little detail. Hunt.io also lists Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China and industrial hosts in Da Nang, Vietnam as targets, and Security Affairs repeats this. Those are targets, not confirmed breaches. For the KMT, Hunt.io says only that it observed a payload designed to hit the party archives with a Shellshock exploit. Its confirmed compromises are the Fengtai environment, the education AI platform and the campus-card system.

Where the Agents Failed

One detail stands out. An unsupported claim of a successful Shiro exploit persisted through the shared context. More than 27 follow-up tests failed, yet GLUTTON assignments for that target continued. In our reading, the framework had talked itself into a result that never happened. Hunt.io’s own heading for it is “AI amplified a false positive.”

This is a useful counterweight to the autonomy narrative. Compare it with the Thai Finance Ministry case we covered, where an agent ran unattended after an operator left: Hermes AI Agent Run Unattended for Post-Exploitation at Thai Finance Ministry. In our reading, both show agent frameworks that are cheap to build and loosely supervised.

Indicators (subset, defanged, from Hunt.io)

Orchestrator and tooling hosts: 81.70.240[.]170, 43.99.61[.]170, 152.42.200[.]25, 129.211.184[.]149, 159.223.64[.]67
SOCKS5 proxies: 43.162.217[.]10:35888, 103.45.65[.]93:35888
Relay domain: *.niestools[.]com
Handle: “Nie” in build paths and proxy credentials
GLUTTON XOR key: d0c41072a0dc784c

Hunt.io also lists file hashes and a long set of webshell names. Take them from the report, not from us.

Defensive Guidance

Hunt.io’s page has no dedicated defensive section, so the following is our assessment.

Patch the entry points it describes: Java and CAS services, and anything exposed to deserialisation attacks. The campaign relied on known weaknesses, not novel ones.
Hunt for webshell drops, LSASS access from web-server processes and new privileged accounts in application platforms such as OA systems.
Search for the XOR key and for PNG responses followed by in-memory class loading.
Watch egress to model APIs and relays from servers. Sustained calls from hosts that never used an LLM are worth an alert.
Treat the AI platform itself as a target. Agent configurations and API secrets sat in the same environment the operator reached.

SecFlow: Operator Ran Claude, Qwen and DeepSeek Agents Against Asian Targets