Loading story…
Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor used an AI-enabled offensive workflow built around Hermes Agent and the DeepSeek model to autonomously scan the internet, identify vulnerable systems, evaluate exploit paths, and launch attacks against exposed services. The activity initially targeted Langflow instances and later shifted to n8n servers after unsuccessful exploitation attempts, showing a repeatable machine-driven cycle of reconnaissance, exploit research, and attack execution with limited human intervention.
Researchers said the campaign did not achieve full compromise through the autonomous workflow alone, but the same actor also conducted manual intrusions that successfully exploited Citrix NetScaler devices, obtained command execution on Marimo notebook instances, and attempted reverse-shell access against Apache Tomcat and VPN targets. Unit 42 gained rare visibility into the operation after Hermes accidentally exposed the operator’s home directory through a public HTTP file server, revealing scripts, target lists, API settings, shell history, and autonomous session logs that showed AI-assisted cyberattacks are already operationally viable against internet-facing infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Unit 42 attributed the Hermes Agent and DeepSeek-enabled activity to a Chinese-speaking threat actor using the aliases knaithe and KnYuan, reportedly based in Zhuhai, China. The report also linked the actor to Telegram-based orchestration and custom offensive Hermes modules.
Jesta Security reported that an autonomous DeepSeek v4 'Flash free' agent began attacking its network on July 2, using hundreds of short-lived SSH sessions over five days to conduct reconnaissance and attempt deployment of MicroSocks SOCKS5 proxies. Jesta said it uncovered a target list of 1,283 hosts with credentials and assessed that about 1,000 additional internet-exposed victims, mostly SMBs, were also targeted to build relay infrastructure for follow-on attacks.
Separate manual operations attributed to the same actor successfully exploited Citrix NetScaler devices, achieved command execution on Marimo notebook instances, and attempted reverse-shell access against Apache Tomcat and VPN targets. These actions were described as distinct from the autonomous Hermes-led exploitation attempts.
Researchers gained visibility into the campaign after Hermes mistakenly exposed the operator’s home directory through an internet-accessible HTTP file server. The exposed data included scripts, target lists, API configurations, command history, and autonomous session logs.
Unit 42 reported that a Chinese-speaking threat actor used an offensive workflow built around Hermes Agent and the DeepSeek model to autonomously scan for vulnerable internet-facing systems, assess exploit paths, and launch attacks with limited human intervention. The activity initially targeted exposed Langflow instances and later shifted to n8n after failed exploitation attempts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcedarkreading.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active espionage intrusion targeting Thailand’s Ministry of Finance, tied to exposed attacker infrastructure at `43.246.208[.]207` and additional linked hosts in Hong Kong and Malaysia. The operation used the open-source **Hermes** autonomous AI agent in unattended "YOLO" mode to enumerate ministry systems, map internal services, and assess privilege-escalation paths, while a previously undocumented cross-platform Go implant dubbed **Hades** was staged to maintain persistence on both Windows and Linux systems. Investigators also linked a VShell C2 server and the domain `redhatupdating432.dnsrd.com` to the activity. Recovered artifacts showed targeting of ministry administrative panels, mail infrastructure, Apache Hadoop and HiveServer2 environments, Apache Ambari, GlassFish, Alfresco, and internal document systems. The exposed directories contained exploit code, web shells, stolen credentials, credential-testing scripts, and Linux and IIS exploitation or privilege-escalation modules, while Hades reportedly supported command and control, file transfer, proxying, and screen capture. Investigators said the evidence indicates compromised internal access, though no data exfiltration had been confirmed at publication time, and assessed with low-to-moderate confidence that the operator was a Chinese-speaking or Sinophone threat actor based on infrastructure history, Chinese-language indicators, and use of FOFA.
Jul 30, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026
Security telemetry indicates **coordinated, large-scale probing of exposed LLM endpoints** consistent with pre-exploitation reconnaissance. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure (Oct–Jan), attributing activity to two operations systematically enumerating AI deployment weaknesses across major model ecosystems (including **OpenAI, Google Gemini, Anthropic, Meta, DeepSeek, Mistral, Alibaba, and xAI**). One operation used two IPs to methodically test API formats and identify live endpoints over an 11‑day period, relying on low-noise prompts (e.g., “hi” and simple factual questions) to reduce detection; GreyNoise noted the IPs’ prior association with exploitation of known vulnerabilities, suggesting reconnaissance feeding a broader exploitation pipeline. In parallel, Check Point described an active **GoBruteforcer (GoBrut) botnet** wave targeting cryptocurrency and blockchain project databases by brute-forcing services such as **FTP, MySQL, PostgreSQL, and phpMyAdmin** on Linux, with campaigns amplified by **reused AI-generated deployment examples** that propagate common usernames and weak defaults, plus exposure from legacy stacks like *XAMPP*. The Register’s coverage of the WEF Global Cybersecurity Outlook 2026 aligns with these observations at a strategic level, reporting that leaders increasingly prioritize **AI security risk assessment** and cite **data leakage** and adversary capability gains as top concerns; however, broader policy and CIO “challenges” commentary does not materially add to the specific reconnaissance/botnet activity described in the threat reporting.
Jun 29, 2026