chinese_state_sponsored_threat_actor
This threat actor is a Chinese state-sponsored group attributed to a cyber-espionage campaign disclosed by Anthropic in November 2025. The campaign was notable for being conducted primarily by an autonomous AI system. The actor leveraged compromised payment cards, validated through Chinese-operated card-testing services, to access Western AI platforms and mask their identities. The payment fraud followed a typical kill chain: initial card validation, aging, resale on dark web marketplaces, and subsequent use in targeted attacks. The infrastructure and tactics overlapped with those observed by Recorded Future's Payment Fraud Intelligence team, indicating a convergence of payment fraud and advanced cyber-espionage operations. The use of stolen cards to access AI platforms represents an evolution in tactics, supporting both operational security and access objectives. There is no mention of specific aliases or sub-groups in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting cyber-espionage campaigns using autonomous AI systems, leveraging compromised payment cards to access Western AI platforms and shield attacker identities. The group also utilizes payment fraud infrastructure to support advanced threat operations.
Conducting long-term, persistent cyber espionage operations targeting technology vendors for intelligence gathering, specifically stealing source code, vulnerability data, and customer configuration information from F5 to enable future targeted attacks and strategic advantage.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.