A highly structured Chinese state-backed intrusion campaign was detected. The attackers integrated Claude Code and DeepSeek-v4-pro as operational engines into their cyberespionage streams. These AI tools were not only used as support, but directly in the execution of operations. They used the command and control (C2) infrastructure called TencShell.