Recently, a major incident has shaken the software supply-chain security landscape: a self-propagating npm worm dubbed ChainDrop has massively compromised the open-source ecosystem, affecting more than 400 npm packages across over 1,300 versions and generating upwards of 2 billion monthly downloads. The worm not only targets AI coding tools and development environments, but also exploits legitimate provenance and signature mechanisms to bypass traditional detection. It conceals its command channel through blockchain-based C2 nodes and achieves AI-agent persistence in development environments by tampering with configuration files such as .claude/settings.json and .vscode/tasks.json, injecting malicious instructions into the AI-assisted tools developers use every day. Around the same time, APT groups were reported to be using autonomous AI agents to carry out attacks, with targets including government agencies in the Taiwan region and an offline AI environment built by the North Korean Kimsuky group. Faced with these highly intelligent and stealthy new attack methods, traditional security detection systems are stretched thin—while ThreatTrace, a core product of AIStorm, the global brand of AsiaInfo Inc., is providing enterprises with precise and efficient detection and response capabilities through an "AI against AI" approach.

As a next-generation Network Detection and Response (NDR) platform, ThreatTrace no longer relies on traditional signature-based detection. Instead, through full-traffic deep packet inspection and local sandbox dynamic analysis, it accurately identifies anomalous outbound behavior and covert C2 communications generated by AI agents at the network layer, effectively closing the coverage gaps that perimeter and endpoint solutions leave on the development-environment side. At the same time, ThreatTrace deeply integrates security alerts with asset intelligence and uses a risk-assessment model to automatically filter low-severity alerts, helping security teams quickly locate real threats within massive volumes of logs.

On the automated response front, ThreatTrace supports seamless integration with other AsiaInfo security products, including ThreatShield (a tens-of-millions-strong threat intelligence library) and NGFW. ThreatShield provides extensive intelligence on malicious packages and C2 domains; combined with ThreatTrace's real-time detection, once a threat is confirmed the platform can automatically invoke firewalls or EDR to execute blocking actions, contain the lateral spread of malicious traffic, and significantly reduce MTTR.

Notably, ThreatTrace has already proven its effectiveness in security support for multiple major national-level events and in manufacturing emergency-response operations. Faced with the new wave of AI-driven attacks, ThreatTrace is helping enterprises build a network security defense that is visible, defensible, and fast to respond—securing an early lead in the new era of "fighting AI with AI."

At AIStorm, cyber resilience is not built through isolated security products. It is achieved through a continuous security cycle of visibility, protection, detection and improvement.

Find 

The first step is knowing what is exposed.

Using External Attack Surface Management (EASM), organisations can continuously discover internet-facing assets, identify shadow IT, uncover forgotten services, and understand where external risks exist before attackers exploit them.

Block 

Once exposure is identified, risks should be reduced as quickly as possible.

Virtual patching provides immediate protection for vulnerable and legacy systems without waiting for maintenance windows, software upgrades or application changes—helping organisations minimise risk while maintaining business continuity.

Monitor 

Cyber threats evolve continuously.

Network Detection & Response (NDR), combined with Threat Intelligence, enables organisations to monitor network activity, detect suspicious behaviour, identify emerging threats, and uncover attacker activity before incidents escalate.

Remediate 

Security does not end after detection.

The final step is closing the loop—prioritising remediation, reducing measurable risk, and continuously strengthening operational resilience as the threat landscape evolves.

This is an Exposure-to-Response approach: transforming cybersecurity from periodic assessments into a continuous security lifecycle.