Skip to content

knaithe Hermes/DeepSeek autonomous exploitation campaign

Summary

Unit 42 reported a Chinese-speaking opportunistic exploit operator, using the aliases knaithe and KnYuan, who configured Nous Research's Hermes Agent with DeepSeek as an autonomous offensive operator. In a recovered May 2026 session, the agent used FOFA and public proof-of-concept repositories to select targets, test prerequisites, abandon low-yield paths, and pivot between Langflow and n8n vulnerabilities without additional visible operator input. The autonomous attempts did not produce a confirmed compromise, but separate manual activity by the same actor achieved data theft or command execution through Citrix NetScaler and marimo vulnerabilities.

The durable lesson is narrower than “AI hacked autonomously”: an inexpensive agent framework, custom skills, internet-asset search, public exploit code, permissive model/tool settings, and Telegram orchestration formed a functional scan-to-exploit loop. Target-side authentication and configuration prerequisites stopped the recovered autonomous attempts. The same autonomy also exposed the actor's workspace when the agent started a Python HTTP server in the home directory.

Tags

Why this matters

  • Unit 42 recovered an end-to-end autonomous workflow that enumerated internet assets, downloaded public exploit code, checked versions and exploit prerequisites, sampled targets to conserve compute, and changed product focus after failures.
  • The observed autonomous Langflow and n8n attempts failed because targets lacked required public flows, auto_login, or unauthenticated upload forms. Secure configuration—not a model refusal—prevented exploitation.
  • The actor's manual campaigns had confirmed impact: Unit 42 reported memory-data exfiltration from three NetScaler targets and command execution on 11 marimo notebook instances.
  • The agent-created file server exposed API keys, tool configurations, exploit scripts, target lists, shell history, and autonomous-session logs, showing that agent tool use can create evidence and operational-security failures for attackers as well as defenders.
  • Unit 42 attributes the activity to a Chinese-speaking operator based in Zhuhai, China, but does not connect it to a known threat group.

Autonomous workflow

Tooling and configuration

The actor used Hermes Agent for terminal access, Telegram orchestration, and reusable skills, with DeepSeek as the primary reasoning engine. Unit 42 recovered three red-team skills: framework-bundled godmode, custom web-terminal-exploitation, and custom fofa-cyberspace-search. The actor also integrated the FofaMap-Platinum-Full-Expert MCP server for FOFA searches, Nuclei scan generation, and natural-language query translation.

Other coding agents were present but had limited observed use:

  • Claude Code was used for connectivity and proxy testing. It ran with permission checks bypassed and 12 tools explicitly allowed.
  • Codex had trusted exploit-development directories and network access enabled, but local response storage was disabled and Unit 42 recovered no chats.
  • Qwen Code had only two recovered sessions and was configured with Qwen, GLM, Kimi, and MiniMax models.
  • Claude Code and Codex traffic passed through code.newcli[.]com; DeepSeek and Qwen used native API endpoints.

These details describe the recovered actor environment, not a claim that every configured model performed exploitation. Unit 42 says OpenAI confirmed its safeguards refused policy-violating requests and that an account believed related to the activity was disabled before intelligence sharing.

Langflow attempt

DeepSeek selected Langflow CVE-2026-33017, downloaded a public proof of concept, enumerated 84 instances with FOFA, and found one target running Langflow 1.3.4. It abandoned the path after determining that exploitation required auto_login or a public flow identifier and the tested targets had neither.

n8n pivot

The agent then surveyed ten product families, searched GitHub for popular 2026 CVE proof-of-concept repositories, and selected n8n based on exposure, severity, and exploit popularity. It acquired a chain for:

  • CVE-2026-21858, arbitrary file read, fixed in n8n 1.121.0.
  • CVE-2025-68613, sandbox bypass to remote code execution, fixed in n8n 1.120.4.

FOFA returned 647,017 n8n instances globally and 25,209 in China according to the source. The agent sampled about 100 Chinese addresses, probed roughly 40, and identified three vulnerable versions. Exploitation still failed because no tested form exposed the required unauthenticated file upload.

Manual activity and exploitation status

Unit 42 separates the recovered autonomous session from conventional manual operations:

Vulnerability Product Reported activity
CVE-2026-33017 Langflow Autonomous attempt failed because prerequisites were absent.
CVE-2026-21858 + CVE-2025-68613 n8n Autonomous attempts failed because tested forms required authentication.
CVE-2026-3055 Citrix NetScaler ADC/Gateway Manual exploitation; memory data exfiltrated from three targets.
CVE-2026-39987 marimo Manual command execution confirmed on 11 instances.
CVE-2026-34486 Apache Tomcat Manual Java-deserialization reverse-shell attempts against nine servers.
CVE-2026-33824 Windows IKE Extensions Manual reverse-shell callbacks targeting three VPN endpoints.
CVE-2026-0300 PAN-OS User-ID portal Nonfunctional public research code cloned; no execution found.

Across autonomous and manual activity, Unit 42 identified more than 460 attempted targets. Its report later says only three targets were successfully exploited, all through NetScaler CVE-2026-3055, even though the same report's manual-campaign section and vulnerability table describe command execution on 11 marimo instances. Preserve that internal scope discrepancy rather than silently adding the counts together. The actor searched leaked NetScaler memory for NSC_AAAC= authentication cookies and repeatedly targeted a Malaysian government entity. Unit 42 also saw evidence of batch exploitation against an unknown number of hosts in a file deleted before analysis.

Attribution and infrastructure notes

  • Aliases: knaithe and KnYuan.
  • Assessment: Chinese-speaking opportunistic exploit operator and self-described binary-security researcher, reportedly based in Zhuhai, China.
  • Public project: 1DayNews, described as aggregating remote-code-execution disclosures from 17 sources, using DeepSeek to filter exploitability, and delivering alerts through Telegram.
  • Proxy: code.newcli[.]com for the recovered Claude Code and Codex configurations.
  • Victimology: opportunistic activity across three countries and multiple sectors; autonomous targeting focused indiscriminately on Chinese domestic infrastructure, while repeated NetScaler exploitation showed greater intent against a Malaysian government target.
  • Caveat: no known APT attribution is established in the public report.

Defender heuristics

  • Prioritize patching and exposure reduction for internet-facing workflow automation, notebooks, VPNs, ADCs, and administrative applications. Validate exploit prerequisites, not only product banners and version strings.
  • Monitor for rapid sequences that join internet-asset search, GitHub proof-of-concept downloads, target-list creation, version probing, threaded scanners, and immediate exploit execution from one host or identity.
  • Treat FOFA, Nuclei, MCP, Telegram, and public exploit repositories as dual-use. Alert on combinations and process lineage rather than any one tool.
  • Inventory agent frameworks and coding agents on administrative, research, and security-testing systems. Log terminal commands, tool calls, skill changes, MCP configuration, model endpoints, and agent-created network listeners.
  • Restrict agent workspaces with dedicated low-privilege users, isolated working directories, egress policy, secretless environments, and approval boundaries. Do not let a generic python3 -m http.server expose a home directory.
  • Hunt internet-facing Langflow and n8n deployments for unexpected form probing, version enumeration, file-upload attempts, arbitrary-file-read indicators, and child processes spawned from application runtimes.
  • For NetScaler CVE-2026-3055 response, preserve memory-leak and access telemetry and revoke potentially exposed session cookies. Search for repeated grooming/read attempts and subsequent session reuse.
  • For marimo CVE-2026-39987, review notebook command execution and child-process activity and rotate cloud, database, and SSH material reachable from the runtime.
  • Preserve attacker-side or compromised-red-team infrastructure when lawfully available: agent transcripts, shell history, target lists, proxy configuration, and skills can reveal scope and intent.

Sources