A Chinese threat actor operating under the aliases “knaithe” and “KnYuan” used multiple LLMs to automate cyberattacks against internet-facing systems with limited human intervention.
Researchers at Palo Alto Networks’ Unit 42 uncovered the operation after the threat actor’s AI agent misconfigured a file server, inadvertently exposing the entire infrastructure.
“This visibility enabled us to understand their full tool set, how the attackers orchestrated multiple AI platforms and gave us a peek into their targeting,” Unit 42 wrote.
“Based on our analysis of their session logs and configuration files, the actor primarily used the Hermes Agent with DeepSeek as its reasoning agent for the attack phase of this campaign. Their Hermes Agent conducted autonomous vulnerability enumeration, downloaded public exploit code from the internet and attempted exploits against targets,” the researchers explained.
After receiving instructions over Telegram, the agent worked autonomously. It searched internet-facing systems through the FOFA search engine, downloaded exploit code from GitHub, and launched attacks without requiring further operator input.
Beyond DeepSeek, the threat actor deployed several other LLMs, including Qwen, GLM, Kimi, and MiniMax. Researchers also found evidence of limited testing of Western AI tools. Claude Code appeared only in connectivity checks and proxy tests, while Codex artifacts were found in exploit development directories.
“This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.”
AI agent prioritized and tested exploits
In one recovered session, the AI agent targeted a Langflow vulnerability tracked as CVE-2026-33017, rated 9.8 in severity. It downloaded a public exploit from GitHub, identified 84 exposed Langflow servers through FOFA, and assessed them for exploitation. Only one appeared potentially vulnerable, but the attack ultimately failed because the required configuration was not enabled.
“The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither. DeepSeek assessed the entire product as a low-value target,” Unit 42 said.
The AI agent then analyzed public exploit repositories, weighing vulnerability severity against deployment scale before selecting n8n, a workflow automation platform that FOFA identified on more than 647,000 internet-exposed servers worldwide, including more than 25,000 in China.
It selected an exploit chaining two vulnerabilities: CVE-2026-21858, an arbitrary file read flaw with a CVSS score of 10.0, and CVE-2025-68613, a sandbox escape vulnerability leading to remote code execution with a CVSS score of 9.9.
Although both flaws had already been patched in newer n8n releases, the AI agent determined that version 1.117.3 predated both fixes and was therefore vulnerable to the exploit chain.
“This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources,” the researchers noted.
Autonomous attack flow observed in Hermes Agent session (Source: Palo Alto Networks)
Although none of the autonomous attacks resulted in a successful compromise, Unit 42 described the workflow as “a functional, end-to-end autonomous offensive capability.”
Manual attacks delivered the results
Outside the AI-driven sessions, the threat actor also conducted hands-on attacks against more than 460 systems, targeting known vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, and Windows IKE VPN, among others.
Three of the manual attacks succeeded, all exploiting CVE-2026-3055 in Citrix NetScaler appliances. The attackers extracted data directly from device memory and searched it for authentication cookies that could be be used to hijack active user sessions.
“The technical barrier to AI-augmented offensive operations is low and continues to decrease,” the researchers concluded.
