The Exfiltration Desk

The joint NSA/CISA/FBI advisory naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI in industrial-scale token extraction campaigns against U.S. frontier models is the most operationally significant economic-espionage disclosure in the AI sector this year. The mechanism matters: 'extracting billions of tokens' from U.S. AI models is not a network intrusion in the classic sense. It is systematic capability harvesting via API access—using the models' own inference infrastructure as the exfiltration channel. This is closer to a systematic trade-secret extraction through a published interface than a breach, which is precisely why it falls outside most breach-disclosure frameworks and why CISA KEV entries won't capture it.

The advisory is notable for what it implies about the timeline: if six named Chinese AI firms have been running these campaigns since a date the advisory does not specify, and DeepSeek's R1 release in early 2025 prompted global discussion about Chinese AI capability acceleration, the extraction campaigns may have materially contributed to that acceleration. The relationship between systematic token extraction and model capability development is not one-to-one—you cannot reconstruct weights from inference outputs—but systematic behavioral mapping across frontier models yields training signal that would otherwise require years of independent research investment.

Cipher Desk colleague Katya Volkov is right to note that the attribution here comes from a joint three-agency advisory, which represents a high-confidence attribution event by U.S. intelligence standards. I would push further: the named entities include commercial companies with regulatory presence in multiple jurisdictions. The question of whether this advisory triggers action by non-U.S. regulators—particularly EU AI Act enforcement bodies—is one that The Regulatory Wire should pick up. What I can say from the counterintelligence vantage is that the 153 million driver's license database for sale on the dark web, reported by Schneier citing Krebs, is a separate but related threat surface: personal identity data at scale enables the social engineering and cover-identity operations that facilitate human-vector collection alongside the technical extraction campaigns described in the advisory.

The joint intelligence agency warning about Chinese AI model distillation is the most important story in today's corpus that will get the least sustained attention. Three U.S. agencies named six specific companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—accusing them of extracting billions of tokens from U.S. models. The technique being described is knowledge distillation: using a more capable model's outputs as training signal for a smaller or differently-architected model, effectively transferring learned representations without access to weights, training data, or code. It is legal in many jurisdictions. It is also a systematic capability-transfer mechanism that bypasses every export control designed around hardware.

This is the channel that counterintelligence frameworks were not built to intercept. Export controls on A100s and H100s, TSMC fab restrictions, entity list designations—all of these assume that capability transfer requires physical hardware or source-code access. Distillation at scale requires only API access and compute. The named companies have had broad API access to OpenAI, Anthropic, and Google models through commercial tiers. The question the agencies are implicitly raising—but which requires legislative rather than executive action to address—is whether commercial API access to frontier U.S. models should be subject to the same screening logic as semiconductor exports.

I'd push Katya on one point: this isn't primarily a cyber story. There are no CVEs here, no intrusion indicators, no lateral movement. The 'attack surface' is a terms-of-service agreement and a credit card. The breach, such as it is, happened in the open, at scale, over months or years. The costly exfiltration already closed. What the agencies are warning about now is the downstream consequence: Chinese frontier model capabilities that were built in part on U.S. model outputs, and which now exist independent of any U.S. leverage.

North Korean operational tempo is worth reading in aggregate today, because the Lazarus Hyperliquid story and the North Korean IT worker expansion story are two faces of the same financing operation. CoinDesk's blockchain analysis — flagged as Contested, sole-source, on wallet attribution — reports more than $30 million in bitcoin sold on Hyperliquid in three weeks. The Hacker News reports separately that DPRK-linked threat actors are now placing infiltrators not just in IT roles but in sales, marketing, and medical professions. The headline breach is the crypto laundering; the more durable capability being built is the human-access layer across sectors that were previously considered lower-risk. Healthcare and sales roles provide access to patient data, enterprise CRM systems, pharmaceutical IP pipelines, and financial workflows — not the crown jewels individually, but exceptionally useful for building operational infrastructure and long-duration access.

I want to draw Katya Volkov's attention to a distinction our desks need to hold carefully here: the Lazarus crypto-laundering activity is a Cipher Desk primary — it is financial crime conducted through cyber channels. What I am tracking is the insider-access vector that the IT worker scheme has now metastasized into. When a DPRK-linked worker is placed in a pharmaceutical sales role with access to clinical trial data, drug-discovery pipelines, or supply-chain logistics for controlled substances, the exfiltration risk is not a crypto transaction — it is a lab notebook, a CRM export, or a departing contractor's hard drive. The sector expansion into healthcare deserves specific attention from life-sciences security teams who may have been watching the IT-sector framing and concluded their exposure was limited.

ValleyRAT, reported by Security Affairs, is a useful operational illustration of the broader DLL-sideloading trend. The Silver Fox threat actor is hiding the RAT behind legitimate adware — not cracked software or fake browser updates, but applications that appear benign. The technique is significant because it degrades the effectiveness of user-behavioral indicators that most enterprise security training programs emphasize. If the delivery vector looks like ordinary adware, the insider-threat detection layer that depends on anomalous installation behavior will miss it.