Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
Summary: Unit 42 documented a Chinese-speaking actor, operating as knaithe and KnYuan, running an autonomous hacking campaign in which DeepSeek, driven through the Hermes Agent framework and commanded over Telegram, enumerated vulnerabilities and attempted exploitation against more than 460 targets. The agent surveyed 10 product families, pivoted from a failed Langflow attempt (CVE-2026-33017) to n8n after FOFA showed 647,017 instances globally and 25,209 in China, and probed about 40 of roughly 100 sampled Chinese IPs, finding three on vulnerable versions without achieving exploitation.
Key Takeaway: Unit 42 confirmed data exfiltration from three Citrix NetScaler targets via CVE-2026-3055 and command execution on 11 Marimo notebook endpoints, while the actor also persistently targeted a Malaysian government entity over multiple days with proxy anonymization. The agent compressed hundreds of hours of manual targeting analysis into minutes, and the actor's own file server exposure showed an operation still iterating on tooling rather than one that had peaked.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026