Full Report
A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. [...]
Analysis Summary
# Threat Actor: knaithe (KnYuan)
## Attribution & Identity
- **Name/Alias:** knaithe, KnYuan.
- **Identification:** A Chinese-speaking threat actor and self-described "binary security researcher."
- **Origin:** China-based.
- **Characteristics:** Proficient in AI-driven offensive workflows and traditional manual exploitation.
## Activity Summary
The actor utilizes an autonomous AI-driven offensive pipeline to identify, analyze, and exploit vulnerable internet-facing servers. In a notable May 2026 campaign, the actor deployed the open-source **Hermes Agent** powered by the **DeepSeek** LLM to conduct end-to-end attacks with minimal human oversight. The agent independently researched vulnerabilities (CVEs), queried asset search engines (FOFA), and attempted to execute exploit code. This actor was also linked to a prior compromise involving Thailand’s Ministry of Finance.
## Tactics, Techniques & Procedures
- **Autonomous Reasoning:** Leverages the DeepSeek AI model as a reasoning engine to analyze exploit repositories and determine attack paths.
- **"YOLO" Mode Operations:** Uses Hermes Agent's autonomous mode to execute terminal commands and risky scripts without human approval.
- **Automated Reconnaissance:** Integrates with the FOFA search engine to identify exposed services at scale.
- **Vulnerability Research:** AI-driven scanning of public exploit repositories to select targets (e.g., n8n, Langflow).
- **Exploit Chaining:** Demonstrated the ability to chain multiple vulnerabilities to achieve unauthenticated access.
- **Manual Exploitation:** Conducts traditional manual attacks alongside AI activities for high-value targets like Citrix NetScaler.
- **Post-Exploitation:** AI-driven service enumeration, container inspection, and credential harvesting (session cookies).
**Relevant MITRE ATT&CK IDs:**
- **T1595:** Active Scanning (FOFA and vulnerability scanning)
- **T1588.006:** Obtain Capabilities: Vulnerabilities (Searching public exploit repos)
- **T1203:** Exploitation for Client Execution
- **T1539:** Steal Web Session Cookie
- **T1083:** File and Directory Discovery
## Targeting
- **Sectors:** Government (Ministry of Finance), technology, and general internet-exposed infrastructure.
- **Geography:** Global (targeting exposed servers), specifically Thailand.
- **Victims:**
- Thailand’s Ministry of Finance.
- Users of Langflow and n8n workflow platforms.
- Organizations running vulnerable Citrix NetScaler and Apache Tomcat instances.
## Tools & Infrastructure
- **AI Models:** DeepSeek (Primary), Qwen, GLM, Kimi, MiniMax, Claude Code, OpenAI Codex.
- **Frameworks:** Hermes Agent (Open-source AI agent).
- **Search Engines:** FOFA.
- **Exploited Software/CVEs:**
- CVE-2026-33017 (Langflow)
- CVE-2026-21858 & CVE-2025-68613 (n8n workflow automation)
- CVE-2026-3055 (Citrix NetScaler)
- Apache Tomcat, Marimo Notebook, Windows IKE VPN.
- **Infrastructure:**
- Telegram (C2 and instruction delivery).
- Exfiltrated data found on open web directories.
## Implications
This actor represents a shift toward **Offensive AI workflows**. By automating the reconnaissance and "target narrowing" phases—which usually take hours or days—into mere minutes, the actor can strike at a scale and speed that exceeds traditional defensive monitoring. While current autonomous attempts have shown high failure rates due to technical nuances (like authentication requirements), the functional end-to-end capability signals a significant reduction in the barrier to entry for complex, multi-stage cyberattacks.
## Mitigations
- **Harden Internet-Facing Services:** Prioritize patching for workflow automation tools (n8n, Langflow) and edge devices (Citrix NetScaler).
- **Enforce MFA:** Ensure all file-upload forms and administrative interfaces require multi-factor authentication to break automated exploit chains.
- **API Key Management:** Monitor for leaked or compromised LLM API keys (DeepSeek, OpenAI) which are essential for these autonomous agents.
- **Anomaly Detection:** Implement behavioral monitoring for rapid, automated terminal activity and unusual outbound connections to asset search engines like FOFA.
- **Review Open Directories:** Regularly scan organizational infrastructure for accidentally exposed web servers or home directories that may leak environment variables and logs.