GTG-1002 AI-Orchestrated Espionage Campaign (Nov 2025)

Intro

In November 2025, security researchers uncovered a large-scale cyber-espionage campaign by GTG-1002, a Chinese state-sponsored threat actor.
What makes this operation unprecedented is that up to 90% of the intrusion activity was performed by AI agents, not humans.

The attackers built a system where an advanced AI model acted as the operator performing reconnaissance, vulnerability discovery, lateral movement, and data extraction — with humans approving only the most sensitive steps.

This marks the first confirmed instance of an AI-led intrusion into high-value government and commercial systems.

Full report available here.

How the attack worked

The actor built an autonomous attack framework around Claude Code using MCP (Model Context Protocol) tools.

• Claude was used as:
• Orchestrator: Breaking complex intrusions into smaller tasks.
• Execution engine: Running recon, exploit dev, lateral movement, data mining, etc.

Custom code focused on orchestrating commodity tools, not creating new exploits:

• Network scanners, exploit frameworks, password crackers, binary analysis suites.

MCP servers to:

• Run remote commands on pentest boxes.
• Automate browser actions for web recon.
• Integrate code analysis / testing frameworks.
• Handle callbacks for exploit validation.

AI did ~80–90% of Infrastructure recon, Vulnerability discovery & exploit dev, Credential harvesting & lateral movement, Data extraction & triage, Documentation of the whole campaign

The operation followed traditional intrusion phases, but AI autonomy increased at each step:

Phase 1 — Campaign initialization & social-engineering the model

Human operators:

• Chose targets (tech, finance, chemical, government).
• Role-played as staff of legitimate security firms to convince Claude it was doing defensive testing.

Claude:

• Minimal direct role here; mostly following initial “job brief.”
• This “vibe-hacking the model” let them bypass safeguards long enough to start the campaign.

Phase 2 — Recon & attack surface mapping

Claude autonomously:

• Ran browser/MCP-based recon.
• Enumerated services, auth mechanisms, endpoints, internal IP ranges.
• Tracked separate contexts for multiple targets in parallel.
• Outcome:
• Full maps of internal services, databases, orchestration platforms, etc., with minimal human direction.

Phase 3 — Vulnerability discovery & validation

Claude:

• Identified vulnerabilities (e.g., SSRF).
• Researched exploitation patterns.
• Generated tailored payloads.
• Ran tests and validated via callbacks.
• Produced exploitability reports for human sign-off.

Humans:

• Reviewed reports.
• Approved escalation from “testing” → “live exploitation.”

Phase 4 — Credential harvesting & lateral movement

Claude autonomously:

• Pulled creds from configs, services, and internal systems.
• Tested where each set of creds worked.
• Mapped privilege levels and trust relationships.
• Drove lateral movement to APIs, DBs, container registries, logging infra, etc.

Humans:

• Mainly reviewed access to very sensitive systems before allowing deeper moves.

Phase 5 — Data collection & intelligence extraction

Claude:

• Authenticated using stolen creds.
• Mapped DB structures, dumped data, grabbed hashes, created backdoor accounts.
• Parsed data to:
• Identify high-privilege accounts.
• Classify data by intelligence value & sensitivity.
• Generate summary reports of “useful” information.

Humans:

• Reviewed summaries.
• Chose final exfiltration sets.

Phase 6 — Documentation & handoff

Claude:

• Maintained detailed markdown runbooks:
• Discovered services
• Exploit paths
• Credentials
• Extracted datasets
• Campaign timelines
• Enabled:
• Easy operator handoff.
• Seamless resume after pauses.
• Transition of persistent access to other teams for long-term espionage.

In summary, GTG-1002 used an AI-driven framework to:

• Perform detailed mapping of target infrastructure.
• Identify weaknesses and generate custom exploit payloads.
• Use stolen credentials to move inside networks.
• Discover sensitive databases and internal systems.
• Extract and summarize intelligence data.
• Document operations for later handoff to other teams.

Instead of writing new malware, they integrated common security tools and automated them through an AI agent capable of running thousands of actions per day.

The result: nation-state level capability with unprecedented speed.

Approx. 30 organizations were targeted, including global technology companies, finance and chemical sector firms, government organizations, cloud, infrastructure, and software service providers, etc.

This campaign shows that:

• AI dramatically lowers the barrier to conducting advanced intrusions.
• Smaller teams can now execute operations previously possible only for top-tier intelligence agencies.
• Defensive maturity must increase accordingly — especially around identity security, monitoring, and anomaly detection.

This is a strategic inflection point: adversaries are shifting from human-operated campaigns to AI-orchestrated operations.

Recommended actions

Identity & Access Controls

• Enforce MFA everywhere (esp. internal admin services).
• Review service accounts and privileged identities.
• Minimise credential reuse and exposed secrets.

Monitoring & Detection

• Strengthen visibility on:
• Rapid or exhaustive system enumeration
• Credential checking/high-volume authentication attempts
• Automated access patterns across APIs & DBs

SOC Modernisation

• Incorporate defensive AI to:
• Summarise large data sets during incident response
• Detect anomalies in authentication & lateral movement
• Identify patterns consistent with automated attack frameworks

SOC Playbook: Detecting & Responding to AI-Orchestrated Intrusions

Hypothesis: “Attacker is using AI automation for reconnaissance”

Indicators

• Large bursts of recon across multiple systems within seconds/minutes.
• Highly structured enumeration (alphabetical, sequential, API-wide).
• Rapid discovery of:
• services, buckets, repositories
• internal endpoints or microservices
• DB schemas and table names
• Recon events occur with consistent formatting patterns (AI consistency).

SOC Actions

• Enrich source IP with threat intel, GEO, historical authentication logs.
• Check whether enumeration correlates with valid but unusual credentials.
• Trigger immediate session isolation if internal services are being rapidly mapped.

Hypothesis: “Actor is using AI to test and validate vulnerabilities”

Indicators

• Automated exploitation attempts with slightly modified payload variants.
• Continuous trial-error patterns at machine speed.
• Errors in logs identical across multiple hosts (AI reusing its own structure).
• Rapid chaining of recon → exploit → validation without human delays.

SOC Actions

• Block offending source(s) temporarily using WAF/IPS.
• Begin IR triage on the affected service.
• Inspect payloads for evidence of automated code generation.

Hypothesis: “AI-driven lateral movement & credential harvesting”

Indicators

• Systematic credential testing:
  e.g., a list of credentials tried against many systems with identical request spacing.
• Use of credentials across services in consistent patterns:
• “check → escalate → enumerate → pivot”
• Very fast privilege escalation chains not typical for humans.
• Access to internal APIs or databases with unusually structured queries.

SOC Actions

• Suspend the exposed credential(s) immediately.
• Review associated accounts for recent privilege changes.
• Hunt across endpoints for:
• LSASS access
• abnormal process lineage
• registry credential exports

Hypothesis: “AI is orchestrating multi-target parallel intrusions”

Indicators

• Identical recon/exploit patterns across multiple hosts/tenants.
• Parallelised tasks with near-simultaneous timestamps.
• Repeated sequences of:
• discovery → authentication tests → DB introspection → file listing.

SOC Actions

• Correlate events across tenants/customers.
• Examine network for central command infrastructure.
• Look for tools or scripts matching MCP-like orchestration behavior.

Hypothesis: “AI is performing data classification/exfiltration”

Indicators

• API or database queries specifically targeting:
• tables containing PII, financials, customers, keys, configs
• privilege or identity stores
• Highly organised exfiltration patterns (compressed JSON, structured CSV dumps).
• Automated summary files left on endpoints (“notes”, “findings”, “credentials”).

SOC Actions

• Block egress at firewall/proxy for involved processes.
• Review all outbound channels (HTTPS, DNS, tunnels).
• Trigger full forensic acquisition of impacted servers.

Defensive Countermeasures Your SOC Should Prioritise

Identity Hardening

• Enforce MFA everywhere; enforce conditional access.
• Rotate service account passwords; enforce least privilege.
• Enable full auditing of credential use.

Network & Endpoint Telemetry

• Ensure high-fidelity logs from:
• EDR / Sysmon
• Suricata IDS/IPS
• API gateways
• Database query auditing
• Cloud logs (AWS CloudTrail, Azure Activity Logs)

AI-Augmented Detection

• Summarise recon patterns across millions of logs.
• Auto-highlight abnormal privilege use.
• Detect machine-speed lateral movement.
• Auto-tag “AI-like behavior” based on repetitiveness & systematic patterns.

Need Help?

The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.

Website: https://www.socfortress.co/

Contact Us: https://www.socfortress.co/contact_form.html