AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek

Unit 42 documented a Chinese-speaking threat actor (knaithe / KnYuan) using an AI autonomous operator (DeepSeek) wired into the Hermes Agent framework to rapidly enumerate, assess, and attempt exploitation of internet-exposed services; exposed operation artifacts revealed API keys, exploit scripts and session logs. DeepSeek autonomously scanned large populations (e.g., ~647k n8n instances), chained vulnerabilities, and although many autonomous attempts failed due to target configuration, Unit 42 confirmed successful data exfiltration from three Citrix NetScaler instances and command execution on 11 Marimo notebook endpoints, demonstrating a significant escalation in attack scale and speed when AI is used for autonomous offensive operations.