TencShell is a known C2 infrastructure used by suspected China-linked threat actors. Hunt.io observed an open directory sharing identical HTTP header fingerprints with TencShell C2, used in AI-assisted intrusions against government and financial systems.