The framing of AI tools in an attacker’s infrastructure can mislead. Dream researchers documented a campaign where a China-nexus actor chained PHP2Shell vulnerabilities (CVSS 9.2) with Fragnesia for privilege escalation, rooting 25 servers across the US, Japan, Taiwan, and South Korea. The discovery made headlines: Claude Code, DeepSeek, and Kimi were found installed on the attacker’s systems.
But the report is careful, and the distinction matters. Dream found no direct evidence these tools generated the exploits. Finding an IDE post-breach tells you the attacker had development capability; it doesn’t confirm they used that capability for exploit writing, or that an LLM component did the work. The tools could be there for secondary operations, backdoor maintenance, or purely incidental.
The larger warning sits in the numbers. The attacker scanned roughly 19,000 targets, narrowed to 240 potential vulnerabilities, and landed 25 successful roots. That’s either highly selective targeting or a substantially lower real-world exploitation rate than CVSS 9.2 might suggest. Neither is reassuring, but the gap is worth tracking.
Sources: Chained PHP2Shell Exploit Roots 25 Servers
Coverage: PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network • PHP2Shell Timeline
Related on this blog: [AUTO] Claude Assists in PLC Exploit Porting, Not Automating It • [AUTO] Blue Moon’s Real Story Isn’t AI • [AUTO] Meta Muse’s Undocumented Microphone Backdoor