Chinese Hacker Uses DeepSeek AI to Automate Vulnerability Exploitation

Palo Alto Networks Unit 42 observed a Chinese-speaking threat actor (knaithe/KnYuan) using DeepSeek AI integrated into the Hermes Agent framework to automate target discovery, vulnerability prioritization, exploit retrieval, and attack execution; while autonomous operations had limited confirmed impact, separate manual operations achieved data exfiltration and remote command execution against multiple targets, and the actor’s tooling mistakes exposed operational artifacts and credentials.