Do Son 
At a glance
| Field | Detail |
|---|---|
| Actor | Chinese-speaking operator, aliases knaithe and KnYuan |
| Activity | AI-enabled autonomous hacking campaign |
| Targets | Internet-exposed infrastructure, Chinese systems, and a Malaysian government entity |
| Scale | 460+ targets attempted; 3 confirmed breaches |
| Status | No charges; attribution assessed by Unit 42; OpenAI disabled a linked account |
| Source | Palo Alto Networks Unit 42 |
TL;DR
Palo Alto Networks Unit 42 uncovered an autonomous AI cyberattack campaign run by a Chinese-speaking actor. The operator wired the DeepSeek model into an open-source agent to scan, pivot, and attack targets on its own. The autonomous attempts mostly failed, yet parallel manual attacks hit three organizations.
What happened
Unit 42 tracked an actor using the aliases knaithe and KnYuan. The actor connected DeepSeek to the Hermes Agent framework and ran it through Telegram. As a result, the agent could enumerate targets, fetch exploits, and launch attacks without a human in the loop. Unit 42 says the workflow “confirmed a functional, end-to-end autonomous offensive capability.”
The researchers got a rare look inside the operation. The agent started a file server in its home directory and exposed everything. Configs, API keys, exploit scripts, target lists, and session logs all spilled out.
Inside the autonomous engine
DeepSeek acted as the reasoning brain. Hermes Agent handled terminal access, command and control, and a skills system. The actor added custom red-teaming skills, including a jailbreak skill and a FOFA search tool. This setup drove the autonomous AI cyberattack from start to finish.
The actor also plugged in an open-source MCP server. It exposed FOFA asset search and a natural-language-to-FOFA query translator. So DeepSeek could turn plain requests into precise internet scans.
Notably, the operator tested Western tools only in a limited way. According to Unit 42, they used Claude Code for connectivity checks and proxy validation. They also showed signs of using OpenAI’s Codex on exploit folders. Provider-side safety controls likely blunted these tools, so the actor favored DeepSeek’s more permissive framework.
The autonomous attack cycle
One recovered session shows the agent at work. First, it tried a Langflow flaw (CVE-2026-33017) but failed on configuration checks. Next, it researched fresh CVEs and pivoted to n8n, a popular automation tool. Then it picked an exploit chain (CVE-2026-21858 and CVE-2025-68613) and hunted Chinese n8n servers.
FOFA counted 647,017 n8n instances worldwide, and 25,209 in China. From those Chinese systems, DeepSeek sampled about 100 and probed roughly 40. It found three vulnerable servers, yet each required authentication. As a result, the agent scored no hits.
Manual attacks landed the only wins
The actor also ran manual operations, and those caused real damage. They exfiltrated memory data from three organizations through a Citrix NetScaler flaw (CVE-2026-3055). Moreover, they searched that data for session cookies, which points to hijacking intent. One Malaysian government entity faced repeated attacks over several days.
Who is behind it
Unit 42 attributes the activity to a Chinese-speaking operator reportedly based in Zhuhai, China. The researchers describe a self-styled security researcher, not a charged criminal. Their assessment rests on GitHub activity, including an automated vulnerability-intelligence pipeline the actor maintains. That pipeline aggregates RCE disclosures from 17 sources and uses DeepSeek to filter for exploitability. No arrests or charges have been reported.
Impact and scale
The actor attempted to hit more than 460 targets, Unit 42 reports. Still, the team confirmed only three successful breaches, all via the Citrix flaw. The autonomous campaigns achieved no full compromise. However, the margin was thin. Target-side settings, not strong defenses, stopped most attacks.
The autonomous process is what stands out. The actor let DeepSeek narrow the scope, likely to save compute. In effect, the system compressed hours of targeting work into minutes. The Hacker News corroborated the campaign and listed the same seven vulnerabilities. The Hermes agent has also appeared in other AI-driven intrusions, which suggests a growing trend.
What comes next and how to stay protected
This case shows that an autonomous AI cyberattack is now practical, not theoretical. Unit 42 warns that “the technical barrier to AI-augmented offensive operations is low.” So defenders should expect faster and wider scanning.
Basic hygiene still helps a lot. Patch internet-facing apps quickly, because the agent chased public proof-of-concept code. Require authentication on every exposed endpoint. Keep non-essential services off the public internet. For indicators and deeper detail, read the full Unit 42 report. OpenAI also confirmed its safeguards refused policy-violating requests and disabled an account it links to this campaign.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
