Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers

1. Executive summary

A Chinese-speaking threat actor using the aliases "knaithe" and "KnYuan" orchestrated autonomous cyberattacks against internet-facing systems using the open-source Hermes Agent framework powered by DeepSeek and multiple other LLMs (Qwen, GLM, Kimi, MiniMax). Discovered by Palo Alto Networks Unit 42 after the actor misconfigured a file server and exposed their infrastructure, the AI agent autonomously enumerated vulnerabilities via the FOFA search engine, downloaded public exploits from GitHub, and attempted exploitation — compressing hundreds of hours of manual targeting analysis into minutes. While autonomous attacks did not achieve successful compromise, the actor's parallel manual attacks against 460+ systems succeeded three times via CVE-2026-3055 (Citrix NetScaler), enabling memory data extraction and authentication cookie theft. Attribution to the named actors is unconfirmed: neither "knaithe" nor "KnYuan" has a MITRE ATT&CK profile.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 24 — digital operational resilience testing — general requirements	The actor used FOFA to identify 647,000+ internet-exposed n8n servers and 84 Langflow servers; the attack chain validates that external attack-surface discovery and exploitation of unpatched internet-facing systems is an active, automated threat vector.	Clients should ensure vulnerability scanning and penetration testing programmes specifically cover internet-facing workflow automation and development platforms (n8n, Langflow, Marimo Notebook) and Citrix NetScaler, validating that resilience testing reflects autonomous AI-driven attack speeds.
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	Three successful manual compromises of Citrix NetScaler via CVE-2026-3055 resulted in memory data extraction and theft of authentication cookies — a potential major ICT-related incident if session hijacking enabled further access.	Clients running Citrix NetScaler should have incident classification and reporting workflows ready for this exploitation pattern; confirmed session-cookie theft from NetScaler memory may meet the major-incident threshold.

3. Technical analysis & attack chain

Attribution caveat: The actors "knaithe" and "KnYuan" have no MITRE ATT&CK profiles; attribution is unconfirmed and rests solely on Unit 42's research. All technical detail below is single-sourced to Unit 42 / Help Net Security reporting — verify before enforcement.

Autonomous AI attack chain (observed in Hermes Agent session logs)

Initial instruction via Telegram. The operator sent an initial instruction to the Hermes Agent over Telegram. No further operator input was recovered in the session logs — the agent operated autonomously thereafter.
Target discovery via FOFA. The agent used the FOFA search engine to identify internet-facing systems. It queried for Langflow servers (84 found) and n8n servers (647,000+ found globally, 25,000+ in China).
Exploit acquisition from GitHub. The agent downloaded public exploit code from GitHub repositories, selecting exploits based on autonomous analysis of vulnerability severity versus deployment scale.
Target 1 — Langflow CVE-2026-33017 (CVSS 9.8). The agent downloaded a public exploit, identified 84 exposed Langflow servers via FOFA, and assessed them. Only one appeared potentially vulnerable, but exploitation failed because the vulnerability requires either auto_login enabled or a public flow ID, and the target had neither. DeepSeek assessed Langflow as a low-value target.
Target 2 — n8n exploit chain. The agent selected n8n and an exploit chaining two vulnerabilities: - CVE-2026-21858 — arbitrary file read, CVSS 10.0 - CVE-2025-68613 — sandbox escape leading to remote code execution, CVSS 9.9

The agent determined that n8n version 1.117.3 predates both patches and is therefore vulnerable to the chain. (Note: both flaws were already patched in newer n8n releases at time of activity.)

Autonomous resource management. The system executed the targeting, sampling, and scope-narrowing process in minutes — work that would normally require hundreds of hours of manual analysis — while managing its own compute resources.

Outcome of autonomous attacks: None resulted in successful compromise. Unit 42 described the workflow as "a functional, end-to-end autonomous offensive capability."

Manual attack chain (parallel hands-on activity)

Target scope. The actor manually attacked 460+ systems targeting known vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, and Windows IKE VPN, among others.
Successful compromises. Three manual attacks succeeded, all exploiting CVE-2026-3055 in Citrix NetScaler appliances.
Data extraction. Attackers extracted data directly from device memory and searched it for authentication cookies that could be used to hijack sessions.

AI tooling observed

Tool	Role
Hermes Agent (open-source framework)	Primary autonomous attack orchestration
DeepSeek	Reasoning agent for the attack phase
Qwen, GLM, Kimi, MiniMax	Additional LLMs deployed
Claude Code	Connectivity checks and proxy tests only (limited testing)
Codex	Artifacts found in exploit development directories (limited testing)
FOFA	Internet-facing system discovery
GitHub	Public exploit code retrieval
Telegram	Initial operator-to-agent instruction channel

4. Mitigation & containment

P1 — Within 24 hours

Citrix NetScaler (CVE-2026-3055): This is the only vulnerability with confirmed successful exploitation in this campaign. If running Citrix NetScaler, immediately check for signs of compromise: review memory access patterns, inspect for anomalous session activity, and rotate all authentication cookies/sessions. Apply the vendor patch if available. This is the highest-priority action — three compromises were confirmed via this CVE.
Hunt for Hermes Agent infrastructure: Search your environment for signs of the Hermes Agent framework, FOFA query artefacts, or connections to GitHub exploit repositories from server-side processes. The actor's infrastructure was exposed via a misconfigured file server — if you host file-sharing services, verify configurations.
Block and monitor Telegram API egress: The initial instruction channel was Telegram. If server-side processes should not communicate with Telegram APIs, block and alert on such connections.

P2 — Within 72 hours

n8n (CVE-2026-21858 + CVE-2026-25958): Identify all internet-facing n8n deployments. Upgrade to a version newer than 1.117.3 — both CVEs are patched in newer releases. If n8n must be internet-facing, restrict access via IP allowlisting or place behind a VPN. With 647,000+ exposed instances, this platform is actively being targeted.
Langflow (CVE-2026-33017): Identify exposed Langflow instances. Ensure auto_login is not enabled and no public flow IDs are exposed. Apply vendor patches. The autonomous agent assessed this as low-value after failed exploitation, but it remains in the actor's target list.
Audit for AI agent frameworks: Search for Hermes Agent or similar autonomous agent frameworks installed on any infrastructure. Check for API keys or credentials for DeepSeek, Qwen, GLM, Kimi, MiniMax, or Claude configured in agent settings.

P3 — Within 7 days

Review external attack surface via FOFA/Shodan/Censys: Determine what your organisation's footprint looks like from these search engines. The actor used FOFA to enumerate targets — ensure your internet-facing systems are inventoried and that no unintended services are exposed.
Patch remaining targeted products: Ensure Apache Tomcat, Marimo Notebook, and Windows IKE VPN are fully patched, as these were among the manual attack targets.
Session token rotation: Given that authentication cookies were stolen from NetScaler memory in successful attacks, review session management and token rotation policies for all externally facing appliances.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, filenames) are available in the source material. Unit 42's disclosure was based on session logs and configuration files recovered from a misconfigured file server, but specific IOCs were not included in the published reporting.

Behavioural indicators

Behaviour	Where to observe	Confidence
Autonomous agent receiving instructions via Telegram, then conducting vulnerability scanning without further operator input	Network egress logs (Telegram API traffic from server-side processes), process logs	Medium — single-sourced to Unit 42
FOFA API queries for Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN	Network egress logs (FOFA API connections)	Medium — single-sourced to Unit 42
Automated download of exploit code from GitHub repositories followed by immediate exploitation attempts	Proxy/egress logs (GitHub traffic from server processes), process execution logs	Medium — single-sourced to Unit 42
Memory data extraction from Citrix NetScaler appliances with searches for authentication cookies	NetScaler memory access logs, session anomaly detection, SIEM alerts on anomalous session token usage	High — confirmed successful exploitation by Unit 42
Presence of Hermes Agent framework with API credentials for DeepSeek, Qwen, GLM, Kimi, or MiniMax	Host filesystem (agent configuration files), API key stores	Medium — single-sourced to Unit 42
Codex artefacts in exploit development directories	Filesystem analysis on developer/build systems	Low — limited evidence per Unit 42

6. Detection

Insufficient indicators to author detection rules. The source material describes behaviours and tool names but does not provide specific strings, file paths, command-line flags, mutex names, registry keys, or network signatures that are artefacts of the threat itself. The product names (DeepSeek, Hermes Agent, FOFA, GitHub) and CVE identifiers are not threat artefacts and cannot form the basis of a reliable YARA or Sigma rule.

7. Sources

Help Net Security — Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers — https://www.helpnetsecurity.com/2026/08/03/deepseek-ai-autonomous-cyberattacks-hermes-agent/ — 2026-08-03
The Hacker News — Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks — https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html — 2026-07
Palo Alto Networks Unit 42 — Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks — https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ — 2026

8. Adverse Trace position

This campaign is operationally significant not because the autonomous attacks succeeded — they did not — but because it demonstrates a working end-to-end autonomous offensive capability that compressed hundreds of hours of manual targeting into minutes. The actor's parallel manual attacks against Citrix NetScaler (CVE-2026-3055) did succeed three times with memory extraction and session-cookie theft, making that CVE the immediate operational risk for EMEA financial services clients. The targeting of n8n (647,000+ exposed instances) and Langflow indicates workflow-automation and low-code platforms are now in active threat-actor target sets. Attribution to "knaithe" / "KnYuan" is unconfirmed (no MITRE ATT&CK profiles); all technical detail is single-sourced to Unit 42. We are treating this as a high-severity advisory due to the confirmed successful exploitation of NetScaler and the demonstrated acceleration of attack workflows via AI autonomy. We will monitor for IOC releases from Unit 42 and for any emergence of the specific CVEs (CVE-2026-3055, CVE-2026-33017, CVE-2026-21858, CVE-2025-68613) in CISA KEV or EPSS data. Clients should prioritise NetScaler patching and n8n version upgrades immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.