Chinese Hacker Uses DeepSeek, Telegram for Autonomous Attacks
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor tracked as knaithe and KnYuan used DeepSeek via the open-source Hermes Agent framework to launch attacks against more than 460 targets across autonomous and conventional workflows.
- The autonomous agent received a single Telegram instruction, then independently found internet-facing systems, abandoned unproductive paths, and selected new exploits based on severity, deployment scale, and apparent exploitability—with no further operator input.
- DeepSeek served as the primary reasoning model, with Unit 42 finding limited use of Claude Code and Qwen Code and possible Codex use in exploit-development directories, though verification was blocked by missing chat logs.
- DeepSeek-led attacks against Langflow and n8n failed: FOFA returned 25,209 n8n systems in China during one session, but DeepSeek sampled ~100, probed ~40, and none of the three vulnerable targets were exploitable due to authentication and configuration requirements.
- The operation was exposed by Hermes Agent's own bug: an unintended python3 -m http.server 8888 started from /home/worker made the operator's API keys, exploit scripts, target lists, shell history, and autonomous-session logs publicly accessible.
- Unit 42 confirmed only three successfully exploited targets across the entire operation, despite separately reporting data exfiltration from three organizations via NetScaler CVE-2026-3055 and command execution on 11 Marimo instances via CVE-2026-39987—numbers the report does not reconcile.
- Unit 42 assesses the operator is based in Zhuhai, China, citing a GitHub profile displaying the name 'KnYuan Knaithe' and an older blog under the same handle describing its author as a Zhuhai binary security researcher, though the assessment stops short of identifying any state connection.
Why it matters: Concrete organizations using Langflow, n8n, Marimo, and customer-managed NetScaler ADC/Gateway SAML appliances now have specific patch versions to apply (Langflow 1.9.0, n8n 1.121.1, Marimo 0.23.0); the incident also demonstrates that off-the-shelf AI agents can perform multi-step exploitation with one Telegram prompt, and that the operator's own misconfigured framework exposed the full operation.
