Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks

Severity
High

Detail

A Chinese-speaking threat actor has been observed using DeepSeek through the Hermes Agent framework to automate reconnaissance, vulnerability research, exploit acquisition and attack attempts against internet-facing infrastructure.

According to Unit 42, the actor tracked under the aliases knaithe and KnYuan built an AI-assisted offensive environment combining DeepSeek’s reasoning capabilities with Hermes Agent’s terminal access, Telegram-based command-and-control functionality, and reusable attack skills.

The activity demonstrates how agentic AI systems can automate significant portions of the attack lifecycle with limited human interaction. Researchers gained visibility into the operation after Hermes Agent unintentionally launched a Python HTTP file server from the attacker’s home directory. The exposure reportedly revealed tool configurations, API keys, target lists, exploit scripts, shell history and autonomous attack-session logs.

How?

DeepSeek was used as the primary reasoning engine, while Hermes Agent handled execution. The actor configured custom skills for LLM jailbreaking, unauthenticated WebSocket exploitation, and FOFA-based asset discovery. An MCP server was also integrated to translate natural-language prompts into FOFA queries, generate Nuclei scans, and conduct internet-wide asset searches.

In one recovered session from May 2026, the agent independently downloaded a public proof-of-concept exploit for CVE-2026-33017, a Langflow vulnerability rated CVSS 9.8. It identified 84 exposed Langflow instances through FOFA, scanned them, and identified one vulnerable host running Langflow 1.3.4. The exploitation attempt failed because the target did not have the required auto_login setting and did not expose a public flow ID. The AI agent subsequently assessed Langflow as a low-value target and autonomously moved toward higher-impact vulnerabilities.

The DeepSeek-powered agent surveyed 10 product families, searched GitHub for trending 2026 vulnerability PoCs, and ranked potential targets based on severity, exposure, and likelihood of exploitation. It then selected n8n workflow automation as a priority after identifying more than 647,000 exposed instances globally, including 25,209 in China. The attack chain targeted CVE-2026-21858, an arbitrary file-read vulnerability rated CVSS 10.0, and CVE-2025-68613, a sandbox-bypass vulnerability rated 9.9 that could lead to remote code execution.

The autonomous system downloaded a public exploit, identified three apparently vulnerable n8n versions, and searched for exposed form-upload endpoints required for exploitation. However, all identified forms required authentication, preventing compromise. The agent subsequently scanned more than 50 additional Chinese targets but did not identify publicly accessible upload forms.

Impact

The AI-directed campaigns did not result in confirmed compromises. However, Unit 42 reported successful manual activity attributed to the same actor. The threat actor allegedly exfiltrated data from three organizations by exploiting CVE-2026-3055 in Citrix NetScaler and achieved command execution on 11 Marimo notebook instances through CVE-2026-39987.

Additional activities included attempts to establish reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. The actor reportedly targeted more than 460 systems across autonomous and manual campaigns. The Citrix NetScaler activity involved searching stolen memory data for NSC_AAAC authentication cookies, indicating an effort to hijack active sessions.

Palo Alto Networks also observed repeated targeting of a Malaysian government entity using refined exploitation parameters and proxy anonymization.

Recommendation

• Rapidly patch internet-facing systems.
• Minimize the use of unauthenticated administrative and file-upload interfaces.
• Continuously inventory internet-exposed assets.
• Monitor for FOFA-style reconnaissance.
• Monitor for unusual bulk-version checks.
• Monitor for public proof-of-concept scanning activity.
• Monitor exploitation attempts targeting workflow automation platforms, VPN systems, and edge devices.

Conclusion

The campaign demonstrates a shift from AI-assisted scripting toward semi-autonomous offensive operations. By combining DeepSeek with Hermes Agent, the threat actor was able to automate reconnaissance, vulnerability research, exploit acquisition, target assessment, and attempts to exploit internet-facing systems.

Although the autonomous attacks described by Unit 42 did not result in confirmed compromises because of secure configuration requirements, the agent was able to independently evaluate failed attacks and pivot toward other targets and vulnerabilities.

The activity shows that AI agents can discover, assess, and move between targets at machine speed, increasing the importance of securing internet-facing infrastructure and continuously monitoring exposed assets.

Source

https://gbhackers.com/chinese-hacker-uses-deepseek-hermes-agent/
https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/