# DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection > Source: > Published: 2026-08-01 00:30:34+00:00 # DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection ## 1. Basic Information - **Article Title**: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks - **Publisher**: Unit 42 - **Publication Date**: 2026-07-30 - **Severity**: High - **Original Source**: [https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) - **Related Malware**: Hermes Agent, FofaMap MCP, Nuclei - **Threat Group**: knaithe / KnYuan (Chinese-speaking threat actor) - **CVEs**: CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824 - **Products & Environments**: Langflow, n8n, Citrix NetScaler, Marimo, Apache Tomcat, Windows IKE ### Related Sources ## 2. Executive Summary Given a single goal via Telegram, the Hermes/DeepSeek combination autonomously executed FOFA enumeration, PoC acquisition, success condition evaluation, and even switched to a different product after a failure. ## 3. Attack Flow ### Autonomous Langflow to n8n Pivot - The operator gave an initial task to Hermes via Telegram. - DeepSeek enumerated 84 Langflow instances on FOFA and downloaded the CVE-2026-33017 PoC from GitHub. - It identified one instance as a vulnerable version, but the attack failed because it lacked `auto_login` or a public flow ID. - It compared the public exposure scale of 10 product groups with GitHub PoC star counts and CVSS scores, then autonomously pivoted to n8n. - It analyzed the chain of CVE-2026-21858 (file read) and CVE-2025-68613 (RCE). - It found 3 vulnerable versions, but the attack failed because the unauthenticated file-upload form was missing. ### Parallel Manual Campaign - The attacker enumerated public devices using FOFA and a custom scanner. - They read NetScaler memory for 3 organizations using CVE-2026-3055 and searched for the `NSC_AAAC` cookie. - They confirmed command execution on 11 Marimo notebooks using CVE-2026-39987. - They attempted reverse shells against Tomcat and IKE VPN. ## 4. Attacker Infrastructure and Execution Environment - **Attacker Infrastructure**: Publicly exposed attack server on `/home/worker` , Telegram C2, and third-party proxies. - **AI Execution**: Hermes Agent provided terminals, skills, and MCP, while DeepSeek handled reasoning and decision-making. - **Targets**: Publicly exposed Langflow, n8n, NetScaler, Marimo, Tomcat, and IKE endpoints. ## 5. Visibility for Victims and Administrators ### Victims and End Users - Autonomous attacks require no user interaction. Fast version probes, scanning, and PoC requests arrive at public services. - Contact traces for version enumeration and scanning remain even on targets where the exploit fails. ### Administrators and SOCs - Product-specific probes, known PoC patterns, and rapid target switching from the same source IP. - Repeated requests after NetScaler memory reads, Marimo command execution, and reverse shell callbacks. ## 6. Success and Failure Conditions ### Success Conditions - Target services are publicly accessible and running vulnerable versions. - Prerequisites are met: Langflow requires `auto_login` or a public flow ID; n8n requires an unauthenticated file-upload form. - PoC acquisition, execution, and egress/reverse shells are not blocked. ### Failure Conditions - Required workflows or forms are private or require authentication. - The target runs a vulnerable version, but configuration prerequisites are not met. - Attack surface reduction, patching, WAF/IPS, and egress filtering block the PoC or callback. - AI provider safety controls or tool permissions block the attack actions. ## 7. What Happens on Success - Full compromise was not confirmed in the autonomous campaign, and Langflow/n8n attempts failed. - In the manual campaign, data exfiltration was confirmed from 3 NetScaler devices, and command execution was confirmed on 11 Marimo instances. - NetScaler cookie searches indicate intent to hijack sessions. - AI compressed hundreds of hours of target selection down to a few minutes, amplifying the speed and scale of attack attempts. ## 8. Observable Logs ### Email ### Proxy / SWG / DNS - FOFA/API queries, GitHub PoC downloads, `api.deepseek.com` , Telegram traffic, `code.newcli.com` , and `curl` /HTTP probes targeting the victims. ### Endpoint / EDR - On the attacker side: Hermes, `fofoapi.py` , Nuclei, PoC scripts, and `python3 -m http.server 8888` . On the victim side: Shells or `curl` spawned by service processes. ### Identity / IdP - Unauthorized use of NetScaler `NSC_AAAC` cookies and abnormal sessions on public management interfaces. ### SaaS / Cloud - Langflow/n8n/Marimo audit logs, GitHub PoC downloads, and AI API/tool-call logs. ### Network - High volume of targets in a short time, version/form endpoint probes, reverse shell callbacks, and repeated out-of-band memory-read requests. ## 9. Attack Success Determination - **Contact Only**: FOFA inclusion or HTTP probes. - **User Interaction**: None required. - **Initial Execution**: Commands or shells spawned from service processes. - **Malware or Auth Success**: Reverse shell connection established, or session established using stolen cookies. - **Data Theft**: NetScaler memory responses and external data staging confirmed. - **Post-Compromise**: Session reuse, internal reconnaissance, and persistent access confirmed. ## 10. Investigation Playbook - **Trigger**: PoC-style probes against public AI/workflow products, NetScaler memory reads, or Marimo child shells. - **Initial Verification**: Check products, versions, configuration prerequisites, source IPs, request bodies, and response sizes. - **Endpoints**: Collect service child processes, temp files, shell history, new accounts, and web shells. - **Authentication & Cloud**: Revoke NetScaler cookies and rotate workflow secrets and API keys. - **Subsequent Operations**: Scan all public assets for the same source IP and PoC URI, and check for egress callbacks and cookie usage. - **Containment**: Take services offline, apply patches, enforce form authentication, rotate secrets, and rebuild compromised hosts. - **Classification**: Recon / Exploit Attempt Failed / Code Execution / Session Theft / Exfiltration / Post-compromise. ## 11. Defense and Detection Ideas - **Single Indicators**: Shells spawned from public services, known PoC URIs, and abnormally large NetScaler responses. - **Correlated Indicators**: Version probe -> PoC download pattern -> exploit request -> service child process -> callback. - **Threat Hunting**: Inventory not only vulnerable versions but also success prerequisites such as `auto_login` and public forms. - **Log Gaps**: Full WAF request logs, service audit logs, process lineage, NetFlow/egress logs, and AI agent tool logs. - **Prioritized Mitigations**: Reduce attack surfaces using ASM, apply rapid patches, enforce workflow authentication, block egress traffic, and shorten secret lifespans. ## 12. Facts, Inferences, and Hypotheses ### Facts - Hermes/DeepSeek performed FOFA enumeration, PoC acquisition, success condition evaluation, and pivoting to n8n within a single session. - Autonomous exploits against Langflow and n8n failed because configuration prerequisites were not met. - The threat actor targeted over 460 assets. - Manual activities confirmed data exfiltration from 3 NetScaler devices and command execution on 11 Marimo instances. - Hermes started an HTTP server on `/home/worker` , exposing the attacker's tools, API keys, and logs. ### Inference - For SOCs, the novelty is not a brand-new TTP, but rather the speed of selecting and iterating known PoCs, combined with autonomous target switching. - Controls are needed not only on AI provider safety measures, but also on agent network/tool permissions and public asset configurations. ### Hypothesis - If similar agents are parallelized across multiple workers, the time window between public PoC release and actual exploitation will shrink even further. ## 13. MITRE ATT&CK Mapping - **T1595.002 – Vulnerability Scanning** (Confidence: High) - **T1588.005 – Obtain Capabilities: Exploits** (Confidence: High) - **T1190 – Exploit Public-Facing Application** (Confidence: High) - **T1059 – Command and Scripting Interpreter** (Confidence: High) - **T1539 – Steal Web Session Cookie** (Confidence: High [Manual phase]) - **T1041 – Exfiltration Over C2 Channel** (Confidence: Medium) ## 14. Unknowns and Further Investigation - Full list of batch targets and additional victims. - Proportion of exploit code generated or modified by AI. - Final use of the stolen NetScaler data. - Future successful cases of autonomous attacks. - Detection of contacts against local public assets. ## 15. Impact on SOCs and Organizations Organizations worldwide increasingly expose tools like n8n, Langflow, AI notebooks, and ADCs/VPNs. Security teams must map not just vulnerability numbers, but also success prerequisites like public forms and auto-login into ASM/CMDB tools, and shorten remediation SLAs anticipating automated scans shortly after PoC publication. ## 16. Summary by Target Audience ### For SOC Teams Separate mere scans from successful exploits. Correlate events from service child processes and callbacks to cookie usage. ### For Administrators Inventory public AI and workflow products, apply patches, enforce authentication, implement egress filtering, and rotate secrets. ### For End Users Be aware of server-side attacks that require no user interaction. Do not rely solely on self-recovery when anomalies or outages occur; preserve logs and report incidents immediately.