Chinese Threat Actor Uses DeepSeek and Hermes Agent to Launch Fully Autonomous Cyberattacks

Palo Alto Networks' Unit 42 has published research documenting what it describes as a significant milestone in offensive AI: a Chinese-speaking threat actor who directed an AI agent with a single Telegram message and then stepped away while DeepSeek autonomously conducted end-to-end cyberattacks — scanning the internet, selecting exploits, adapting to failures, and exfiltrating data without further human input.

The threat actor, identified online as knaithe (also known as KnYuan), is assessed to be based in Zhuhai, China and self-describes as an opportunistic exploit operator and binary security researcher. Unit 42 makes no confirmed state-nexus attribution.

The Hermes Agent Framework

The attacks were carried out using Hermes Agent, an open-source, persistent AI agent framework released by Nous Research in February 2026. Hermes is model-agnostic — it works with DeepSeek, Claude, GPT-4, Gemini, Qwen, and others — and was designed as a powerful general-purpose agentic platform. In this case, it was weaponized.

Key architectural features that made it effective for offensive use:

• 70+ tools across 28 toolsets — including terminal execution, browser automation, file access, vision processing, and MCP (Model Context Protocol) integrations
• Session memory backed by SQLite with full-text search — enabling the agent to build and retain context across long-running operations
• Multiple terminal backends — local, Docker, SSH, and cloud execution environments
• Skills system — the agent writes reusable operational skills to ~/.hermes/skills/, persisting them across restarts
• Telegram C2 interface — operators issue instructions via Telegram; the agent responds and reports back through the same channel
• YOLO mode — a setting that disables human approval prompts for dangerous commands, enabling fully unattended autonomous operation. The threat actor had this enabled.

The Attack Chain

Unit 42 recovered a session from May 2026 that illustrates the autonomous capability in detail:

1. The operator sent a single Telegram instruction — no further messages were recovered
2. DeepSeek generated FOFA (Chinese internet reconnaissance platform) queries and enumerated 84 Langflow AI builder instances on the internet
3. The agent identified one running Langflow v1.3.4 and downloaded a public exploit for CVE-2026-33017 (code injection, CVSS 9.8)
4. Exploitation failed — the target had auto_login disabled and no public flow ID
5. DeepSeek autonomously assessed Langflow as low-value and surveyed 10 product families to find a better target — with no human prompting
6. The agent selected n8n workflow automation as higher-value and chained CVE-2026-21858 (arbitrary file read, CVSS 10.0) with CVE-2025-68613 (sandbox bypass to RCE, CVSS 9.9)
7. Authentication requirements on Chinese n8n instances blocked exploitation; the agent moved on

This adaptive behavior — failing, self-evaluating, and pivoting without operator input — is what distinguishes this campaign from previous AI-assisted attack attempts.

Seven Vulnerability Tracks Across 460+ Targets

The full campaign spanned 460+ targets and tracked seven vulnerability families:

Confirmed Impact

• 3 organizations had data exfiltrated via the Citrix NetScaler vulnerability. The actor specifically searched exfiltrated data for NSC_AAAC= cookies, indicating the goal was session hijacking for persistent access to VPN/remote access infrastructure.
• 11 Marimo Notebook instances achieved confirmed remote code execution.

Unit 42 noted that AI-assisted attacks were approximately 4x faster than equivalent manual operations, with data exfiltration occurring in under one hour in some cases.

Operational Security Failure — and What It Revealed

The threat actor's operational security failed in an instructive way. When issuing a file-serving instruction to Hermes Agent, the agent started an HTTP file server from /home/worker — the actor's home directory — rather than a staging subdirectory, exposing the entire workspace to anyone who knew the IP.

Separately, Hunt.io archived three open directories on IP 43.246.208[.]207 between July 9–13, 2026, recovering 585 files and 470 MB of attack code, tooling, and stolen credentials.

Despite this exposure, the actor showed signs of operational awareness: exploit directories had been emptied after use, and Codex conversation logging had been manually disabled. The actor's environment showed four AI coding tools configured with loosened local safeguards: DeepSeek (primary), Qwen, GLM, Kimi, and MiniMax — and limited use of Claude Code and OpenAI Codex.

Thailand Ministry of Finance: A Separate but Related Campaign

Hunt.io and researcher Bob Diachenko separately documented the same actor using Hermes Agent (YOLO mode enabled) against Thailand's Ministry of Finance. The agent performed system enumeration, privilege escalation, file and service discovery, and network reconnaissance autonomously. It used LinPEAS for Linux privilege escalation and enumerated a content directory containing PDF, DOC, and XLS files — including personnel records of the Office of Permanent Secretary for Finance.

The actor staged 62 cross-platform payloads (Windows and Linux builds) named "Hades" on port 8080 as an implant delivery server. The underlying infrastructure previously hosted a ShadowPad controller and was running a VShell C2 listener — tools associated with Chinese-nexus threat actors.

Thailand's CERT and NCSA were notified July 15, 2026, with a 7-day disclosure window observed before public publication. No confirmed data exfiltration was reported.

What This Means

Unit 42 frames this campaign as a landmark:

"Large language models can now drive end-to-end offensive operations with minimal human oversight."

The key implication is not that AI is inventing new attack techniques — it is dramatically lowering the skill floor and operator time required to execute complex, multi-stage attacks. A single Telegram message triggered a multi-hour autonomous operation spanning seven vulnerability families and hundreds of targets.

For defenders, several priorities follow directly from this research:

1. Patch internet-facing platforms immediately — the seven CVE families exploited in this campaign (Langflow, n8n, Citrix, Tomcat, Marimo, PAN-OS, Windows IKE) should be treated as active exploitation targets
2. Monitor for FOFA-sourced reconnaissance — Chinese-origin recon traffic from FOFA precedes autonomous exploitation in this actor's workflow
3. Restrict Citrix NetScaler admin interfaces — the 3 confirmed exfiltrations targeted session cookies; enforce network-level access controls on management endpoints
4. Audit AI agent deployments — organizations using Hermes, LangChain, CrewAI, or similar frameworks should review whether YOLO/auto-approve modes are enabled and which tools are available to agents
5. Treat AI tools as attack surface — Langflow and n8n instances exposed to the internet were primary targets; require authentication on all workflow automation endpoints

The full Unit 42 research is available at unit42.paloaltonetworks.com.