Threats Day: AI-Powered Hacking, 370 Chrome Flaws, Sonic Wall Attacks, DNS Hijacking + 22 More Stories
Summary: A Chinese-speaking actor using the aliases knaithe and KnYuan ran an AI-enabled autonomous hacking campaign against seven vulnerabilities in Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, PAN-OS, and Windows IKE Extensions, using DeepSeek through the Hermes Agent framework as the offensive operator and Telegram for command and control. Unit 42 said the agent autonomously searched for critical CVEs and scanned GitHub for trending proofs of concept when initial exploitation failed, and the actor also used Claude Code, Codex, and Qwen Code in a limited capacity.
Key Takeaway: The agent surveyed 10 product families and prioritized targets by attack surface without a human in the loop, so the window between a PoC appearing on GitHub and an exploit attempt is now measured in the agent's runtime, not an attacker's workweek.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026