Chinese Hacker Commands Deep Seek via Telegram to Launch Autonomous Attacks
Summary: Palo Alto Networks' Unit 42 reports that a Chinese-speaking operator using the aliases knaithe and KnYuan used DeepSeek through the open-source Hermes Agent framework to run attacks autonomously after a single Telegram instruction, with no further operator input recovered in the session. The operator launched exploitation attempts against more than 460 targets across seven exploit tracks spanning eight CVE identifiers, though Unit 42 says it could confirm only three successfully exploited targets across the entire operation.
Key Takeaway: The agent checked versions, downloaded exploits, abandoned an unproductive path, and picked its next vulnerability on severity, deployment scale, and apparent exploitability - and the operation was exposed only because Hermes Agent accidentally started a public HTTP server that leaked its API keys, exploit scripts, and target lists. Unit 42's own report states data exfiltration from three organizations and command execution on 11 Marimo instances, then says only three targets were confirmed exploited, and does not reconcile the two.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68613CVE-2026-21858CVE-2026-3055CVE-2026-33017CVE-2026-39987
- Related
- CVE-2026-39987: Marimo Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 23, 2026CVE-2026-3055: Citrix Net Scaler Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Mar 30, 2026