Unit 42 Catches Chinese-Speaking Threat Actor Running DeepSeek Agent for Autonomous Cyberattacks

Palo Alto Networks’ Unit 42 published research on July 30 documenting a Chinese-speaking threat actor who wired DeepSeek into the open-source Hermes Agent framework to run autonomous cyberattacks. The actor, tracked under the aliases “knaithe” and “KnYuan” and traced to Zhuhai, China, used the agent stack to enumerate targets, source exploit code from GitHub, and initiate attacks without human intervention.

The campaign targeted seven vulnerabilities across Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and PAN-OS. Across roughly 460 attempted targets, Unit 42 confirmed three successful compromises involving memory data exfiltration from Citrix NetScaler instances and suspected session hijacking against a Malaysian government entity.

How the Attack Stack Worked

DeepSeek served as the reasoning engine. Hermes Agent, an open-source framework from NousResearch, provided terminal access, skills orchestration, and Model Context Protocol (MCP) integrations. The actor controlled the entire pipeline through Telegram, according to Unit 42 researcher Andy Piazza.

The actor had customized Hermes Agent with three red-teaming skills: a “godmode” jailbreaking module bundled with the framework, a custom unauthenticated WebSocket exploitation tool, and a FOFA cyberspace search procedure that let DeepSeek query internet-facing assets directly. An integrated MCP server exposed FOFA asset search, Nuclei scan generation, and a natural-language-to-FOFA query translator.

In a recovered session from May 7, 2026, the agent autonomously attempted to exploit Langflow via CVE-2026-33017 (CVSS 9.8). It downloaded a public proof-of-concept from GitHub, enumerated 84 Langflow instances through FOFA, and ran the scanner. When exploitation failed because the target had authentication enabled, DeepSeek assessed the entire product family as low-value and pivoted on its own.

The agent then surveyed deployment counts across 10 product families, scanned GitHub for trending CVE repositories sorted by stars, and selected n8n as a higher-value target. FOFA confirmed 647,017 n8n instances globally, with 25,209 in China. DeepSeek attempted to chain CVE-2026-21858 (arbitrary file read, CVSS 10.0) with CVE-2025-68613 (sandbox bypass to RCE, CVSS 9.9), but authenticated form requirements blocked the exploit chain.

The Broader Toolkit

DeepSeek was the primary offensive engine, but the actor was shopping. GBHackers reported that the exposed environment showed four AI coding tools configured with loosened local safeguards. Claude Code and OpenAI’s Codex were tunneled through a proxy at code.newcli[.]com to reduce traceability, while DeepSeek and Qwen were accessed directly through native APIs.

Claude Code usage was limited to connectivity testing and proxy validation across 10 entries in three sessions, according to Unit 42. Codex showed signs of usage on exploit development directories, though chat logs were not preserved because the actor had configured response storage to be disabled. The actor also configured Qwen, GLM, Kimi, and MiniMax, consistent with evaluating the Chinese AI model market.

Anti-attribution settings were enabled across tools. Claude Code had attribution headers set to zero and nonessential traffic disabled. Codex had response storage turned off. Qwen Code ran in “yolo” approval mode, auto-approving all tool executions.

How It Was Exposed

The entire operation was revealed by accident. Hermes Agent, responding to a Telegram command, launched an HTTP file server from /home/worker instead of a sandboxed directory. This exposed AI tool configurations, exploit scripts, target lists, session logs, and API keys. Artifact analysis and GitHub activity tied the actor to Zhuhai.

Three Compromises, Hundreds of Failures

The 3-for-460 success rate tells two stories simultaneously. Defensive fundamentals still work: authentication requirements, network segmentation, and proper configuration blocked the autonomous chains that, on paper, should have succeeded. The n8n chain targeted a CVSS 10.0 vulnerability with 647,000 exposed instances, and authentication alone stopped it.

But the compression matters. What Unit 42 documented was a single actor surveying 10 product families, scanning GitHub for trending exploits, enumerating hundreds of thousands of targets, and pivoting between attack chains, all through an agent that required minimal human oversight. The research confirms that open-source LLMs and agent frameworks have reached the threshold where autonomous offensive operations are functional, even if not yet efficient.