Full Report
Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan,
Analysis Summary
# Threat Actor: knaithe / KnYuan
## Attribution & Identity
- **Actor Name/Alias:** knaithe, KnYuan.
- **Language/Origin:** Chinese-speaking threat actor.
- **Identity/Associations:** Identified by Palo Alto Networks’ Unit 42. The actor is associated with the use of the open-source **Hermes Agent** framework for autonomous cyber operations.
## Activity Summary
In a campaign observed through mid-2026, the actor utilized AI reasoning models (primarily DeepSeek) to automate the discovery and exploitation of internet-facing systems. After receiving an initial instruction via Telegram, the AI agent operated autonomously to select targets, research vulnerabilities, and download exploits. The actor launched exploitation attempts against over 460 targets using both autonomous AI workflows and manual conventional methods.
## Tactics, Techniques & Procedures
- **Autonomous Exploitation:** Using AI agents to perform reconnaissance, vulnerability research, and exploit execution without human intervention.
- **Vulnerability Research:** Automated searching of GitHub for Proof-of-Concept (PoC) repositories and surveying product families for exploitability.
- **Scanning & Recon:** Using search engines like FOFA to identify vulnerable internet-facing instances.
- **Exploit Chaining:** Combining multiple vulnerabilities (e.g., n8n file access + expression injection) to achieve Remote Code Execution (RCE).
- **Command & Control (C2):** Utilizing Telegram as an interface to command the Hermes Agent framework.
- **Operational Blunder:** Inadvertently starting a Python HTTP server (`python3 -m http.server 8888`) which exposed API keys, logs, and shell history to researchers.
**MITRE ATT&CK IDs (Inferred from context):**
- **T1595.002:** Active Scanning: Vulnerability Scanning
- **T1203:** Exploitation for Client Execution
- **T1105:** Ingress Tool Transfer
- **T1059:** Command and Scripting Interpreter
## Targeting
- **Sectors:** Technology, Software Development, and organizations using workflow automation/AI development tools.
- **Geography:** Global, with a specific focus on systems located in China (e.g., 25,209 n8n systems scanned).
- **Victims:**
- 460+ targets total.
- 3 organizations confirmed for data exfiltration via NetScaler.
- 11 Marimo instances for command execution.
- Attempted (but failed) attacks on Langflow and n8n instances.
## Tools & Infrastructure
- **AI Models:** DeepSeek (primary), Claude Code, Qwen Code, and Codex.
- **Frameworks:** Hermes Agent (Open-source autonomous framework).
- **Vulnerabilities Exploited:**
- **CVE-2026-3055:** NetScaler memory-overread.
- **CVE-2026-39987:** Marimo RCE.
- **CVE-2026-33017:** Langflow code injection.
- **CVE-2026-21858 & CVE-2025-68613:** n8n vulnerability chain.
- **Infrastructure:** Telegram (Commanding), FOFA (Scanning), GitHub (Exploit sourcing).
- **Local IP/Port:** `127.0.0.1:8888` (Internal exposure via Hermes Agent).
## Implications
This campaign represents a significant shift toward **Autonomous Cyber Attacks**. By leveraging LLMs (Large Language Models) for reasoning, threat actors can scale their operations exponentially, allowing a single operator to target hundreds of organizations simultaneously with minimal manual effort. The ability of the agent to "pivot" when an exploit fails demonstrates an evolving sophistication in automated decision-making during offensive operations.
## Mitigations
- **Patch Management:** Prioritize patching for Langflow (v1.9.0+), n8n (v1.121.1+), and Marimo (CVE-2026-39987).
- **Appliance Security:** Update customer-managed NetScaler ADC or Gateway appliances, especially those configured as SAML identity providers.
- **Access Control:** Remove public internet access to sensitive workflow and notebook interfaces (Langflow, n8n, Marimo) or enforce strict Multi-Factor Authentication (MFA).
- **Monitoring:** Monitor for unauthorized Python-based web servers or unusual outbound traffic to AI API providers and Telegram IP ranges.