Mapping 200 still undetected Chinese AI attack platforms in the wild

Last week we took one ThreatFox alert and asked Mesmer Agent, the AI analyst in Houdin, to identify similar infrastructure. It came back with 280 servers running CyberStrikeAI, an open-source AI-driven attack platform with its own C2. Fifteen of them are known C2 servers. Around 200 have no record in threat intel platforms, not even a port-scan pulse. Most were set up in the last six weeks.

The whole pivot was one question and a few minutes of investigation. Here is how it went.

First contact

On 17 September 2026, ThreatFox listed 45.112.206[.]54, an address in a Hong Kong hosting range, as an AdaptixC2 server on port 55005.

We scanned it in Houdin. Reputation sources had a few hits and not much else:

Netlas scans the whole internet on a rolling basis and keeps what every address answers: open ports, software, certificates and the pages it serves. That is how it holds what a host looked like before anyone flagged it: Netlas had captured that page on 13 September, four days before the ThreatFox listing.

Figure 1 The Netlas node of the scan

CyberStrikeAI

CyberStrikeAI is an open-source, AI-driven offensive security platform written in Go, with about 7,000 stars on GitHub. It puts more than a hundred security tools behind a chat interface, drives them through MCP, and ships its own C2 with listeners, encrypted beacons and a webshell manager. The web interface listens on 8080 by default, in Chinese, over HTTPS with a self-signed certificate generated at install time. The certificate subject is CyberStrikeAI, and so is the page title.

Those two details are the whole investigation. A certificate subject and a page title that the tool sets itself are fingerprints for every installation.

Figure 2 The CyberStrikeAI login page on port 55000

urlscan.io capture, 22 September 2026

Pivoting

We asked Mesmer Agent: “who else runs this?”

After identifying the default certificate and title fingerprinting weakness, it used its Netlas pivoting tools to create and run two queries:

certificate.subject.common_name:"CyberStrikeAI"
http.title:"CyberStrikeAI"

Together they return 295 records on 280 distinct servers.

• 200 servers match both.
• 70 match only the title, because they serve the page over plain HTTP or behind another certificate.
• 10 match only the certificate: their operators renamed the login page (“FenL AI”, “GuiRAI”, “OGSTAYLORESCAN”, “Test”, or a Chinese title) and forgot that the certificate still says CyberStrikeAI.

Figure 3 The pivot, as Mesmer Agent ran it

Certificate issue dates give the deployment timeline for the 232 servers that have one. The earliest was set up on 24 May 2026. 189 of the 232 were set up since 10 August, 98 in September alone, and the week of 7 September brought 52 new ones.

This attack framework is proliferating fast, with tens of new installations in the week of 7 September alone.

What the feeds know

The agent then handed every address to Houdin’s CTI reputation tools:

We also sampled a third of the fleet on VirusTotal, 84 servers picked at random. Half had no engine detection at all, and of the servers the feeds do not know, 54 out of 55 sit at two engines or fewer, which on a bare IP address is background noise.

201 of the 280 servers have no record in any of the feeds.

Hunt for it yourself

The two Netlas queries above find every installation, on any port. If you can only see the page, one marker survives a renamed title and certificate: the localStorage key cyberstrike-theme.

In Houdin, a scan of any address runs the Netlas host summary and gathers each web port’s root page, which is how we detected this threat in the first place, with no query written by hand.

On paid plans, six pivot tools are exposed over Houdin’s MCP server, so you can also run this pivoting investigation from Claude Code, Codex or any MCP client.

Indicators

Already listed on ThreatFox:

All 280 servers detected on 24 September: