Chinese Hacker Commands DeepSeek via Telegram in Autonomous Attack Wave

Palo Alto Networks' Unit 42 has revealed that a Chinese-speaking threat actor tracked under the aliases knaithe and KnYuan used the DeepSeek reasoning model through the open-source Hermes Agent framework to run largely autonomous cyberattacks after a single Telegram instruction. The agent identified internet-facing systems, evaluated public exploits, and executed exploitation attempts against more than 460 targets using seven exploit tracks spanning eight CVE identifiers. Researchers recovered no further operator input during the session, underscoring how AI-driven agents can compress the operator-to-exploitation timeline to a single chat message.

The operation targeted a familiar stack of exposed enterprise tools. DeepSeek-led attacks against Langflow and n8n workflows failed because the exposed systems did not meet exploit configuration requirements, while separate manual operations succeeded against NetScaler ADC and Gateway appliances via the SAML identity-provider memory-overread flaw CVE-2026-3055, resulting in data exfiltration from three organizations, and against 11 Marimo notebook instances via command-execution flaw CVE-2026-39987. In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection bug CVE-2026-33017, enumerated 84 instances through FOFA, and identified one target running version 1.3.4 before aborting because auto_login was not enabled. Unit 42 ultimately confirmed only three successfully exploited targets across the entire campaign. Organizations running customer-managed NetScaler appliances, Langflow, n8n, or Marimo instances should patch immediately and verify exposure using an open port scanner and an SSL/TLS configuration checker, while removing unnecessary public access to workflow and notebook interfaces.

The campaign was exposed by an operational mistake inside Hermes Agent itself: the framework launched `python3 -m http.server 8888` from `/home/worker`, leaking the actor's model configurations, API keys, exploit scripts, target lists, shell history, and autonomous-session logs to the open internet. DeepSeek served as the primary reasoning engine, with limited use of Claude Code and Qwen Code and possible Codex activity in exploit-development directories, though the latter could not be confirmed because chat logs were not preserved. Defenders can probe their own external footprint with a WHOIS lookup on suspicious infrastructure tied to their domains. The Hermes framework's own documentation confirms Telegram-based command execution and unattended task scheduling, signaling that agentic AI tooling has crossed from proof-of-concept into live offensive use by state-aligned actors.