The actor targeted infrastructure using seven vulnerabilities and combined autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.
DeepSeek and Hermes Agent: an autonomous offensive stack
Unit 42 observed a Chinese-speaking threat actor, operating as knaithe and KnYuan, assemble an integrated offensive environment that placed DeepSeek — accessed through the Hermes Agent framework — at the center of autonomous operations. Hermes Agent supplied orchestration (terminal access, Telegram-based command and control and a skills system) while DeepSeek acted as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making. The agent independently enumerated targets via FOFA, sourced public exploit code from GitHub and attempted exploits without further human input.
The actor configured custom Hermes skills — named godmode (an LLM jailbreaking skill), web-terminal-exploitation (an unauthenticated WebSocket exploitation skill) and fofa-cyberspace-search (a template instructing DeepSeek to use the actor’s fofoapi.py script) — and integrated an open-source FofaMap-Platinum-Full-Expert Model Context Protocol (MCP) server to translate natural language into FOFA queries and to generate Nuclei scans.
Seven CVEs, automated pivoting, and rapid sampling
Unit 42 documented DeepSeek autonomously identifying, prioritizing and pivoting on vulnerabilities. In a May 7, 2026 Hermes session, DeepSeek located a Langflow bug (CVE-2026-33017, CVSS 9.8), downloaded a public PoC from GitHub, enumerated 84 Langflow instances via FOFA and ran a scanner that identified one Langflow 1.3.4 instance. Exploitation failed because the target required either auto_login enabled or a public flow ID.
DeepSeek then surveyed ten product families, scanned GitHub for trending 2026 CVE PoCs and prioritized targets by severity, footprint and exploitability. It selected n8n as a higher-value target after FOFA reported 647,017 n8n instances globally and 25,209 in China. DeepSeek fetched the Chocapikk PoC chain that combined CVE-2026-21858 (arbitrary file read, CVSS 10.0) with CVE-2025-68613 (sandbox bypass to remote code execution, CVSS 9.9). From ~25,209 Chinese n8n instances DeepSeek sampled roughly 100 IP addresses, probed about 40 unique IPs via curl version checks, found three vulnerable instances and attempted automated exploitation; none had publicly accessible forms and the autonomous attempts did not achieve exploitation.
Unit 42 notes the actor maintained exploit tooling for seven vulnerabilities in total, and attempted exploitation against more than 460 targets across a mix of autonomous and manual techniques.
Manual operations and confirmed impact
Separate from the autonomous campaigns, the actor ran manual workflows (FOFA enumeration, custom Python scanners and direct exploitation) that produced confirmed impact. Unit 42 confirmed three organizations had memory data exfiltrated through a Citrix NetScaler out‑of‑bounds memory read (CVE-2026-3055). The actor searched exfiltrated memory for NetScaler authentication cookies (NSC_AAAC=), indicating session-hijacking intent, and persistently targeted a government entity in Malaysia over multiple days with memory grooming and maximum read attempts, returning later with proxy anonymization. Unit 42 also observed command execution on 11 Marimo notebook instances (CVE-2026-39987), Java deserialization reverse shell attempts against nine Apache Tomcat servers (CVE-2026-34486) and reverse shell callbacks targeting three IKE VPN endpoints (CVE-2026-33824).
For some staged exploits the actor merely cloned public PoC repositories—for example, a PAN-OS User‑ID buffer overflow PoC (CVE-2026-0300) whose cloned code was non‑functional and showed no evidence of modification or execution.
Operational security failure: an exposed workspace revealed the toolchain
The campaign’s most consequential mistake was technical and accidental. Hermes Agent was instructed — via Telegram — to start an HTTP file server (python3 -m http.server 8888) from the actor’s home directory (/home/worker) instead of an isolated staging area. That error exposed the actor’s entire workspace, revealing AI tool configurations, API keys, exploit scripts, target lists, bash history and Hermes autonomous exploitation session logs. The exposure let Unit 42 reconstruct the full operational environment, including the actor’s use of multiple LLMs (Qwen, GLM, Kimi, MiniMax), limited connectivity testing of Western platforms (Claude Code and signs of Codex use) and routing choices (Claude Code and Codex traffic proxied through code.newcli[.]com while DeepSeek and Qwen were accessed via native APIs).
The records show anti‑attribution settings applied to tools (for example, CLAUDE_CODE_ATTRIBUTION_HEADER set to "0" and Codex configured with disable_response_storage = true) and a broader operational pattern: the actor emptied exploit directories after use and disabled Codex conversation logging, while simultaneously iterating on custom skills and proxy infrastructure.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Unit 42 highlights specific defensive controls customers can enable. Cortex XDR and Cortex XSIAM are cited for post‑exploitation protection (Advanced WildFire, Behavioral Threat Protection, Local Analysis module) and Endpoint Protection Modules (EPM) for exploit types; Cortex Xpanse can identify exposed Langflow, n8n and Citrix ADC/Netscaler devices and escalate findings when ASM rules are enabled. Palo Alto Networks also lists specific Threat Prevention signature IDs (97030, 96882, 96855, 97044, 97046, 97251, 97177, 510019) defenders can apply.
- Policymakers and platform stewards: Unit 42 reports that provider‑side safeguards on at least one Western model refused policy‑violating requests and that colleagues at OpenAI confirmed their safety systems flagged and disabled an account believed linked to this campaign. The case underscores that model‑level controls changed actor tool choices; the actor selected a permissive model (DeepSeek) when provider safeguards limited Western tools.
- Affected enterprises and procurement leaders: the finding that DeepSeek could rapidly sample and narrow tens of thousands of exposed instances into a handful of exploitable targets reinforces the value of patching and correct default configurations: n8n advisories show patches for CVE‑2026‑21858 (fixed in 1.121.0) and CVE‑2025‑68613 (fixed in 1.120.4). Enabling attack-surface discovery and ASM alerts is an explicit defensive recommendation.
Unit 42’s central observation is explicit: the significance of this case is in the trajectory, not a single outcome. The actor built a persistent, iterating AI‑augmented offensive pipeline — custom skills, MCP integration, proxying and Telegram orchestration — and paired it with manual operations that produced confirmed exfiltration. The technical barrier is low and falling; the offensive environment was scalable and modular, and a single operational slip exposed the full chain. Defenders who act on the specific mitigations above — patching, enabling discovery and applying signature and behavioral protections — are the immediate first line against the next iteration.
