A Chinese-speaking operator using two orchestration harnesses and a model proxy. Mechanism, preconditions and effects. CrowdStrike described a Chinese-speaking operator with two harnesses accessing Claude through a China-based proxy service. One harness used deterministic reconnaissance and handed selection of predefined actions to the model; the other…
Inspect the ClaimsCase · DiggingBeagle record
Claude Code campaigns through a Chinese proxy
Scope
Exposed operator-framework records, May-August 2026.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- AI role
- BY AI
Basis and provenance
CLM-CS-CHINESE-HARNESSES-1 reports: The operator compromised government entities in two countries. Source SRC-2026-CP17-CROWDSTRIKE-CAMPAIGNS is located at 'Threat Actor 2'. The distinctive mechanism begins: CrowdStrike described a Chinese-speaking operator with two harnesses accessing Claude through a China-based proxy service. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: Monitor the actual effects and infrastructure of scanning, login and privilege-changing tool calls rather than treating use of an AI proxy as sufficient attribution. There is no evidence here that restricting a particular model alone prevents a human-operated campaign. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CS-CHINESE-HARNESSES-1 · CrowdStrike: Four agentic intrusion campaigns
At a glance
Victim-side corroboration was not independently inspected.
Limits and uncertaintyFull account
A Chinese-speaking operator using two orchestration harnesses and a model proxy.
Mechanism, preconditions and effects. CrowdStrike described a Chinese-speaking operator with two harnesses accessing Claude through a China-based proxy service. One harness used deterministic reconnaissance and handed selection of predefined actions to the model; the other allowed a more flexible Claude Code workflow with optional parallel specialist agents. The operator targeted more than 20 named organizations and, according to the vendor, compromised government entities in two countries.
Comparison and evidence limits. Language, proxy geography and target selection do not by themselves establish state sponsorship or actor nationality. The two harnesses are operational alternatives within one observed operator cluster, not two independent attackers. Their relative autonomy also differs from the rigid supervisor/executor workflow reported for the Argentine group.
Timeline
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-CS-CHINESE-HARNESSES-1The operator compromised government entities in two countries.supported
Basis: reported finding
- supportsCrowdStrike: Four agentic intrusion campaignsprimary disclosure
Threat Actor 2
Controls and mitigations
- Monitor the actual effects and infrastructure of scanning, login and privilege-changing tool calls rather than treating use of an AI proxy as sufficient attribution. There is no evidence here that restricting a particular model alone prevents a human-operated campaign.
Unknowns and contradictions
- Victim-side corroboration was not independently inspected.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183