Suspected Chinese hackers broke into 25 servers, including government-linked firewalls

Suspected Chinese hackers have broken into 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. Security firm Dream says the attackers likely still have access to at least one of those networks. The break-ins began October 23 and hit organizations in the US, Japan, Taiwan and South Korea.

What happened

The attackers used a custom-built attack that combined two tools. The first, called PHP2Shell, lets an outsider run commands on a vulnerable server without logging in. The second, called Fragnesia, is a Linux flaw that turns limited access into full control, known as root. Dream says the whole chain, from first contact to full control, took under 15 minutes.

The entry point was a firewall management page that should never have been open to the internet. Dream says one government-linked firewall led to a second server inside the network within hours, followed by a campaign against Active Directory, the system many organizations use to manage staff accounts.

What the attackers did inside

• Stole credentials and other sensitive information.
• Listed every user and group in the network.
• Tried guessing passwords against every user account.
• Tried to create backdoor accounts and extract signing keys.

Dream does not know whether the password guessing worked, whether the backdoor accounts were created, or whether the keys were taken. Those results were not among the files it recovered.

AI and a target list

Researchers found signs the attackers used AI tools, including Anthropic's Claude Code and a security platform called aiscan set up with Chinese models DeepSeek and Kimi. Dream says the attack was not fully autonomous. The attackers also used FOFA, a Chinese search engine for internet-connected devices, to find about 19,000 Palo Alto firewalls open to the internet.

Who is affected

The compromised firewalls ran vulnerable versions of Palo Alto's PAN-OS software, specifically versions 12.1 and 12.2. Palo Alto's Unit 42 team confirmed Dream's findings about the attackers' tools. CISA added the Fragnesia flaw to its list of actively exploited bugs on Wednesday. CISA and the FBI declined to comment.

What happens next

Dream warns that the tunnel into the US government organization is probably still running. It also says the attackers can return to their 19,000 targets as they learn more about other PAN-OS versions.