Unit 42: DeepSeek Powers Autonomous Attack Campaign by Chinese Actor

A Palo Alto Networks Unit 42 investigation published this week documented what the researchers describe as the first confirmed attribution of a fully autonomous AI attack campaign to a named threat cluster. The actor, tracked internally as knaithe and overlapping with prior KnYuan activity assessed to originate from Zhuhai, ran a sustained exploitation campaign against more than 460 targets using DeepSeek and an open-source agentic framework called Hermes Agent, coordinated through a Telegram bot interface. The campaign ran for approximately six weeks before the actor inadvertently exposed their own infrastructure.

The result was not especially destructive — three confirmed successful exploitations out of 460+ attempts — but the methodology is the story. This is the clearest documented case to date of an AI model serving as the attack orchestrator rather than a tool the human operator reaches for between steps.

How the Campaign Worked

The technical architecture was not exotic. The actor deployed Hermes Agent, a Telegram-integrated agentic framework that wraps LLM API calls with tool use capabilities, and configured it to use DeepSeek as its reasoning backbone. Targets were fed into the system as a queue. Hermes Agent handled reconnaissance, selected exploits from a curated toolkit, initiated sessions, and attempted to chain vulnerabilities toward persistence objectives.

The operator’s role was largely supervisory: reviewing successful access events in the Telegram interface, adjusting priority on the target queue, and occasionally intervening when the agent stalled. Unit 42 estimates the actor was running campaigns for multiple hours at a time with minimal active engagement.

The exploit toolkit targeted four vulnerability classes. CVE-2026-33017, a remote code execution vulnerability in Langflow fixed in version 1.9.0, was the primary initial access vector. Against n8n instances, the agent chained two vulnerabilities — CVE-2026-21858 and CVE-2025-68613 — to achieve RCE from an unauthenticated position. Marimo, a Python notebook platform popular with data science teams, was targeted via CVE-2026-39987 (patched in version 0.23.0). The fourth vector was CVE-2026-3055, a NetScaler SAML authentication bypass, used against targets where Citrix gateways protected internal resources including AI tooling and corporate applications.

The Self-Exposure That Broke the Operation

The campaign’s exposure came through an operational security failure. During an active run, the actor launched a Python HTTP server on TCP port 8888 on their staging infrastructure — a standard technique for hosting payloads during exploitation — without restricting access. Unit 42 researchers scanning for exposed Hermes Agent infrastructure discovered the open directory, which contained the actor’s tool manifests, a Telegram bot configuration file with partial API credentials, and Chinese-language operational notes.

The infrastructure correlated with prior KnYuan-attributed scanning activity. The Zhuhai ASN association and Chinese-language artefacts support a China-nexus attribution, though Unit 42 stops short of linking the cluster to a specific state organisation.

Three of the 460+ attempted targets yielded confirmed access. Whether the low success rate reflects the quality of the target list, patch coverage among the targeted organisations, or the agent’s limitations in adapting to non-standard configurations is not clear from the Unit 42 report.

What This Means for Defenders

The significance here is not the three compromises. It is the operational architecture. An actor with access to a commodity agentic framework, an API key for a capable LLM, and a curated exploit toolkit can now run continuous automated exploitation campaigns at a scale that would previously have required a team.

The exploit targets in this campaign are a useful signal. Langflow, n8n, and Marimo are AI-native tools — workflow builders, notebook environments, and orchestration platforms — that are often deployed with less operational security rigour than production web infrastructure. They are internet-exposed by design, run on developer workstations and internal servers, and frequently lag on patching. The NetScaler SAML bypass rounds out a campaign that can move from an external AI tool deployment directly to internal network access in a single chain.

Defensive priorities from this campaign: patch CVE-2026-33017 in Langflow (1.9.0 required), update n8n to 1.121.1 or later, update Marimo to 0.23.0 or later, and treat NetScaler SAML authentication configurations as high-priority review items. Organisations should also audit which AI workflow tools in their environment are reachable from the public internet and whether those exposures are intentional.

The broader question this campaign raises is how quickly this model scales. The actor’s 460-target queue and six-week campaign timeline suggest a relatively manual curation process. The bottleneck is probably not the AI but the operator’s ability to maintain and prioritise the target list. Remove that bottleneck and the scale changes considerably.

References

• Unit 42 / Palo Alto Networks: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks