Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Unit 42 analyzed a Chinese-speaking threat actor operating an AI-augmented offensive environment (DeepSeek + Hermes Agent) that autonomously enumerated targets, downloaded public exploit PoCs, and attempted exploitation of seven CVEs; parallel manual operations achieved confirmed data exfiltration from three organizations. The report details the actor’s toolchain, proxy and anti-attribution configurations, autonomous attack workflow, CVE engagement (including high-severity CVSS 9.8–10.0 vulnerabilities), limited successful impacts, attribution evidence, and recommended Palo Alto Networks protections and incident response contacts.