Anoymask

DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection

1. Basic Information

  • Article Title: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
  • Publisher: Unit 42
  • Publication Date: 2026-07-30
  • Severity: High
  • Original Source: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
  • Related Malware: Hermes Agent, FofaMap MCP, Nuclei
  • Threat Group: knaithe / KnYuan (Chinese-speaking threat actor)
  • CVEs: CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824
  • Products & Environments: Langflow, n8n, Citrix NetScaler, Marimo, Apache Tomcat, Windows IKE

Related Sources

2. Executive Summary

Given a single goal via Telegram, the Hermes/DeepSeek combination autonomously executed FOFA enumeration, PoC acquisition, success condition evaluation, and even switched to a different product after a failure.

3. Attack Flow

Autonomous Langflow to n8n Pivot

  1. The operator gave an initial task to Hermes via Telegram.
  2. DeepSeek enumerated 84 Langflow instances on FOFA and downloaded the CVE-2026-33017 PoC from GitHub.
  3. It identified one instance as a vulnerable version, but the attack failed because it lacked auto_login or a public flow ID.
  4. It compared the public exposure scale of 10 product groups with GitHub PoC star counts and CVSS scores, then autonomously pivoted to n8n.
  5. It analyzed the chain of CVE-2026-21858 (file read) and CVE-2025-68613 (RCE).
  6. It found 3 vulnerable versions, but the attack failed because the unauthenticated file-upload form was missing.

Parallel Manual Campaign

  1. The attacker enumerated public devices using FOFA and a custom scanner.
  2. They read NetScaler memory for 3 organizations using CVE-2026-3055 and searched for the NSC_AAAC cookie.
  3. They confirmed command execution on 11 Marimo notebooks using CVE-2026-39987.
  4. They attempted reverse shells against Tomcat and IKE VPN.

4. Attacker Infrastructure and Execution Environment

  • Attacker Infrastructure: Publicly exposed attack server on /home/worker, Telegram C2, and third-party proxies.
  • AI Execution: Hermes Agent provided terminals, skills, and MCP, while DeepSeek handled reasoning and decision-making.
  • Targets: Publicly exposed Langflow, n8n, NetScaler, Marimo, Tomcat, and IKE endpoints.

5. Visibility for Victims and Administrators

Victims and End Users

  • Autonomous attacks require no user interaction. Fast version probes, scanning, and PoC requests arrive at public services.
  • Contact traces for version enumeration and scanning remain even on targets where the exploit fails.

Administrators and SOCs

  • Product-specific probes, known PoC patterns, and rapid target switching from the same source IP.
  • Repeated requests after NetScaler memory reads, Marimo command execution, and reverse shell callbacks.

6. Success and Failure Conditions

Success Conditions

  • Target services are publicly accessible and running vulnerable versions.
  • Prerequisites are met: Langflow requires auto_login or a public flow ID; n8n requires an unauthenticated file-upload form.
  • PoC acquisition, execution, and egress/reverse shells are not blocked.

Failure Conditions

  • Required workflows or forms are private or require authentication.
  • The target runs a vulnerable version, but configuration prerequisites are not met.
  • Attack surface reduction, patching, WAF/IPS, and egress filtering block the PoC or callback.
  • AI provider safety controls or tool permissions block the attack actions.

7. What Happens on Success

  • Full compromise was not confirmed in the autonomous campaign, and Langflow/n8n attempts failed.
  • In the manual campaign, data exfiltration was confirmed from 3 NetScaler devices, and command execution was confirmed on 11 Marimo instances.
  • NetScaler cookie searches indicate intent to hijack sessions.
  • AI compressed hundreds of hours of target selection down to a few minutes, amplifying the speed and scale of attack attempts.

8. Observable Logs

Email

  • No direct email vectors.

Proxy / SWG / DNS

  • FOFA/API queries, GitHub PoC downloads, api.deepseek.com, Telegram traffic, code.newcli.com, and curl/HTTP probes targeting the victims.

Endpoint / EDR

  • On the attacker side: Hermes, fofoapi.py, Nuclei, PoC scripts, and python3 -m http.server 8888. On the victim side: Shells or curl spawned by service processes.

Identity / IdP

  • Unauthorized use of NetScaler NSC_AAAC cookies and abnormal sessions on public management interfaces.

SaaS / Cloud

  • Langflow/n8n/Marimo audit logs, GitHub PoC downloads, and AI API/tool-call logs.

Network

  • High volume of targets in a short time, version/form endpoint probes, reverse shell callbacks, and repeated out-of-band memory-read requests.

9. Attack Success Determination

  • Contact Only: FOFA inclusion or HTTP probes.
  • User Interaction: None required.
  • Initial Execution: Commands or shells spawned from service processes.
  • Malware or Auth Success: Reverse shell connection established, or session established using stolen cookies.
  • Data Theft: NetScaler memory responses and external data staging confirmed.
  • Post-Compromise: Session reuse, internal reconnaissance, and persistent access confirmed.

10. Investigation Playbook

  • Trigger: PoC-style probes against public AI/workflow products, NetScaler memory reads, or Marimo child shells.
  • Initial Verification: Check products, versions, configuration prerequisites, source IPs, request bodies, and response sizes.
  • Endpoints: Collect service child processes, temp files, shell history, new accounts, and web shells.
  • Authentication & Cloud: Revoke NetScaler cookies and rotate workflow secrets and API keys.
  • Subsequent Operations: Scan all public assets for the same source IP and PoC URI, and check for egress callbacks and cookie usage.
  • Containment: Take services offline, apply patches, enforce form authentication, rotate secrets, and rebuild compromised hosts.
  • Classification: Recon / Exploit Attempt Failed / Code Execution / Session Theft / Exfiltration / Post-compromise.

11. Defense and Detection Ideas

  • Single Indicators: Shells spawned from public services, known PoC URIs, and abnormally large NetScaler responses.
  • Correlated Indicators: Version probe -> PoC download pattern -> exploit request -> service child process -> callback.
  • Threat Hunting: Inventory not only vulnerable versions but also success prerequisites such as auto_login and public forms.
  • Log Gaps: Full WAF request logs, service audit logs, process lineage, NetFlow/egress logs, and AI agent tool logs.
  • Prioritized Mitigations: Reduce attack surfaces using ASM, apply rapid patches, enforce workflow authentication, block egress traffic, and shorten secret lifespans.

12. Facts, Inferences, and Hypotheses

Facts

  • Hermes/DeepSeek performed FOFA enumeration, PoC acquisition, success condition evaluation, and pivoting to n8n within a single session.
  • Autonomous exploits against Langflow and n8n failed because configuration prerequisites were not met.
  • The threat actor targeted over 460 assets.
  • Manual activities confirmed data exfiltration from 3 NetScaler devices and command execution on 11 Marimo instances.
  • Hermes started an HTTP server on /home/worker, exposing the attacker's tools, API keys, and logs.

Inference

  • For SOCs, the novelty is not a brand-new TTP, but rather the speed of selecting and iterating known PoCs, combined with autonomous target switching.
  • Controls are needed not only on AI provider safety measures, but also on agent network/tool permissions and public asset configurations.

Hypothesis

  • If similar agents are parallelized across multiple workers, the time window between public PoC release and actual exploitation will shrink even further.

13. MITRE ATT&CK Mapping

  • T1595.002 – Vulnerability Scanning (Confidence: High)
  • T1588.005 – Obtain Capabilities: Exploits (Confidence: High)
  • T1190 – Exploit Public-Facing Application (Confidence: High)
  • T1059 – Command and Scripting Interpreter (Confidence: High)
  • T1539 – Steal Web Session Cookie (Confidence: High [Manual phase])
  • T1041 – Exfiltration Over C2 Channel (Confidence: Medium)

14. Unknowns and Further Investigation

  • Full list of batch targets and additional victims.
  • Proportion of exploit code generated or modified by AI.
  • Final use of the stolen NetScaler data.
  • Future successful cases of autonomous attacks.
  • Detection of contacts against local public assets.

15. Impact on SOCs and Organizations

Organizations worldwide increasingly expose tools like n8n, Langflow, AI notebooks, and ADCs/VPNs. Security teams must map not just vulnerability numbers, but also success prerequisites like public forms and auto-login into ASM/CMDB tools, and shorten remediation SLAs anticipating automated scans shortly after PoC publication.

16. Summary by Target Audience

For SOC Teams

Separate mere scans from successful exploits. Correlate events from service child processes and callbacks to cookie usage.

For Administrators

Inventory public AI and workflow products, apply patches, enforce authentication, implement egress filtering, and rotate secrets.

For End Users

Be aware of server-side attacks that require no user interaction. Do not rely solely on self-recovery when anomalies or outages occur; preserve logs and report incidents immediately.