A Chinese-speaking threat actor has been observed using DeepSeek through the Hermes Agent framework to automate reconnaissance, vulnerability research, exploit acquisition, and attack attempts against internet-facing infrastructure.
According to Unit 42, the actor tracked under the aliases knaithe and KnYuan built an AI-assisted offensive environment that combined DeepSeek’s reasoning capabilities with Hermes Agent’s terminal access, Telegram-based command-and-control functionality, and reusable attack “skills.”
The campaign demonstrates how threat actors can use agentic AI systems to execute much of the attack lifecycle with limited human interaction.
Researchers gained visibility into the operation after the Hermes Agent unintentionally launched a Python HTTP file server from the attacker’s home directory.
Chinese Hacker Uses DeepSeek and Hermes Agent
The exposure reportedly revealed tool configurations, API keys, target lists, exploit scripts, shell history, and autonomous attack-session logs.
DeepSeek acted as the primary reasoning engine, while Hermes Agent orchestrated execution. The actor configured custom skills for LLM jailbreaking, unauthenticated WebSocket exploitation, and FOFA-based asset discovery.
They also integrated an MCP server capable of translating natural-language prompts into FOFA queries, generating Nuclei scans, and conducting internet-wide asset searches.
In one recovered session from May 2026, the agent independently downloaded a public proof-of-concept exploit for Langflow vulnerability CVE-2026-33017, rated CVSS 9.8. It identified 84 exposed Langflow instances through FOFA, scanned them, and found one vulnerable host running Langflow 1.3.4.
However, exploitation failed because the target lacked the required auto_login setting and did not expose a public flow ID. Rather than continuing unsuccessful attempts, the AI agent assessed Langflow as low value and pivoted autonomously toward higher-impact vulnerabilities.
The DeepSeek-powered agent then surveyed 10 product families, searched GitHub for trending 2026 vulnerability PoCs, and ranked candidates by severity, exposure, and likelihood of exploitation.
It selected n8n workflow automation as a priority target after identifying more than 647,000 exposed instances globally, including 25,209 in China.
The attack chain targeted CVE-2026-21858, an arbitrary file-read flaw with a CVSS score of 10.0, and CVE-2025-68613, a sandbox-bypass vulnerability rated 9.9 that could lead to remote code execution.
The autonomous system downloaded a public exploit, identified three apparently vulnerable n8n versions, and searched for exposed form-upload endpoints required for exploitation.
All identified forms required authentication, preventing compromise. The agent subsequently scanned more than 50 additional Chinese targets but did not find publicly accessible upload forms.
Although the AI-directed campaigns did not result in confirmed compromises, Unit 42 reported successful manual activity by the same actor.
The threat actor allegedly exfiltrated data from three organizations by exploiting Citrix NetScaler vulnerability CVE-2026-3055 and achieved command execution on 11 Marimo notebook instances via CVE-2026-39987.
Other activities included attempts at reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. The actor reportedly targeted more than 460 systems across autonomous and manual campaigns.
The Citrix NetScaler activity was especially concerning: the operator searched stolen memory data for NSC_AAAC authentication cookies, suggesting an effort to hijack active sessions.
Palo Alto Networks also observed repeated targeting of a Malaysian government entity using refined exploitation parameters and proxy anonymization.
The campaign highlights a practical shift from AI-assisted scripting to semi-autonomous offensive operations. Defenders should prioritize rapid patching of internet-facing systems, minimize the use of unauthenticated administrative and file-upload interfaces, and continuously inventory exposed assets.
Organizations should also monitor for FOFA-style reconnaissance, unusual bulk-version checks, public PoC scanning behavior, and exploitation attempts targeting workflow automation, VPN, and edge devices.
While this actor’s autonomous attacks were stopped by secure configuration requirements, the research shows that AI agents can now discover, assess, and pivot between targets at machine speed.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
