13 minhigh
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
Unit 42 documented an autonomous AI-enabled cyberattack campaign in which a Chinese-speaking threat actor used DeepSeek (via the Hermes Agent framework) as an autonomous offensive operator, orchestrated through Telegram, to independently perform reconnaissance via FOFA, source public exploit PoCs from GitHub, and attempt exploitation across seven CVEs affecting Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, PAN-OS, and Windows IKE VPN extensions. The actor also evaluated Western AI tools (Claude Code, Codex) in a limited testing capacity routed through an anti-attribution proxy, but relied on DeepSeek due to its lack of provider-side safety restrictions; while most autonomous exploitation attempts failed due to target-side configuration barriers, manual campaigns achieved confirmed data exfiltration from Citrix NetScaler targets, and the AI agent's own actions inadvertently exposed the entire operational infrastructure.
Sens:▲ 24h
Showing defanged values
- domaincode[.]newcli[.]comThird-party proxy service used to route Claude Code and Codex traffic to reduce traceability/anti-attribution.
- filenamefofoapi.pyCustom script used by the actor's fofa-cyberspace-search skill for internet asset enumeration via FOFA.
- filenamelangflow_poc.pyPoC scanner script downloaded and run by the autonomous agent to scan for vulnerable Langflow instances.
Detection / HunterAnthropic
What Happened
Security researchers discovered a hacker (using the online names knaithe and KnYuan) who built a system that lets an artificial intelligence chatbot called DeepSeek automatically search the internet for vulnerable computer systems, find hacking tools online, and try to break in — all without a human telling it what to do at each step. This affects organizations running certain software products (like workflow automation tools, remote access gateways, and web servers) that had unpatched security flaws. This matters because it shows that AI can now perform hours of manual hacking work in minutes, lowering the bar for cybercriminals to launch attacks at scale, even though in this case most of the AI's attack attempts failed and only a few targets (including a government agency) were actually compromised. Organizations should make sure their internet-facing software is patched and properly configured, since the AI's attacks only succeeded when target systems had weak default settings, and defenders should keep monitoring for the specific vulnerable products named in the report.
Key Takeaways
- A Chinese-speaking threat actor (aliases knaithe/KnYuan) built a functional, end-to-end autonomous offensive AI pipeline using DeepSeek via the Hermes Agent framework, orchestrated over Telegram, to independently enumerate targets via FOFA, source exploits from GitHub, and attempt exploitation without human intervention.
- The actor tested Western AI platforms (Claude Code, Codex) in limited capacity for connectivity/proxy validation, routed through a third-party proxy (code.newcli.com) for anti-attribution, but appeared to favor DeepSeek because it had minimal provider-side safety restrictions compared to Western models.
- The autonomous agent inadvertently exposed its entire operational environment (API keys, exploit scripts, target lists, session logs) by starting an unintended HTTP file server in its home directory, illustrating a novel OPSEC risk unique to autonomous AI operations.
- Seven CVEs were maintained in the actor's tooling (Langflow, n8n chained CVEs, Citrix NetScaler, Apache Tomcat, Marimo Notebook, PAN-OS User-ID, Windows IKE Extensions); confirmed successful exploitation was limited to three Citrix NetScaler targets with data exfiltration, including suspected session hijacking via NetScaler auth cookies against a Malaysian government target.
- The autonomous AI workflow compressed what would normally take hundreds of hours of manual reconnaissance/target triage into minutes, demonstrating that AI-driven attack cycles are operationally viable even though this specific campaign had limited real-world impact.
Affected Systems
- Langflow (version 1.3.4 and related deployments)
- n8n Workflow Automation (versions prior to 1.121.0 / 1.120.4)
- Citrix NetScaler ADC & Gateway
- Apache Tomcat servers
- Marimo Notebook instances
- PAN-OS User-ID Authentication Portal (Captive Portal)
- Windows systems with IKE VPN extensions enabled
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-33017 | Langflow | 9.8 (Critical) | Vulnerability requiring auto_login enabled or a public flow ID; autonomous exploitation attempt failed due to target misconfiguration. |
| CVE-2026-21858 | n8n Workflow Automation | 10.0 (Critical) | Arbitrary file read vulnerability chained with CVE-2025-68613 for exploitation via unauthenticated form with file upload. |
| CVE-2025-68613 | n8n Workflow Automation | 9.9 (Critical) | Sandbox bypass leading to remote code execution, chained with CVE-2026-21858. |
| CVE-2026-3055 | Citrix NetScaler ADC & Gateway | 9.8 (Critical) | Out-of-bounds memory read vulnerability actively exploited to exfiltrate memory data including authentication cookies from three organizations. |
| CVE-2026-34486 | Apache Tomcat | 7.5 (High) | Java deserialization vulnerability used in reverse shell attempts against nine Tomcat servers. |
| CVE-2026-39987 | Marimo Notebook | 9.8 (Critical) | Vulnerability enabling confirmed command execution on 11 Marimo notebook instances. |
| CVE-2026-0300 | PAN-OS User-ID Authentication Portal (Captive Portal) | 9.8 (Critical) | Buffer overflow vulnerability; actor cloned a public non-functional PoC with placeholder values, no successful exploitation observed. |
| CVE-2026-33824 | Windows IKE Extensions (IKE VPN) | 9.8 (Critical) | Vulnerability used in reverse shell callback attempts against three IKE VPN endpoints. |
Attack Chain
- Reconnaissance: Autonomous Hermes Agent (powered by DeepSeek) uses FOFA to enumerate internet-exposed instances of target products (e.g., 84 Langflow instances).
- Exploit Sourcing: Agent downloads public PoC exploit code from GitHub, prioritizing candidates by CVSS score, deployment footprint, and GitHub star count.
- Initial Exploitation Attempt: Agent runs PoC scanner against Langflow targets (CVE-2026-33017); fails due to missing auto_login/public flow ID prerequisite.
- Autonomous Pivot: Agent independently abandons Langflow, surveys 10 product families, and selects n8n as a higher-value target based on CVSS 10.0 and popularity signals.
- Secondary Exploitation Attempt: Agent chains CVE-2026-21858 and CVE-2025-68613 against n8n targets identified via FOFA, but fails because required unauthenticated form endpoints are protected by authentication.
- Manual Follow-on Operations: Actor manually exploits Citrix NetScaler (CVE-2026-3055) for confirmed data exfiltration, Marimo Notebook (CVE-2026-39987) for command execution, Apache Tomcat (CVE-2026-34486) and Windows IKE VPN (CVE-2026-33824) for reverse shell attempts.
- Exposure: Autonomous agent inadvertently starts an HTTP file server in its home directory, exposing tool configurations, credentials, exploit scripts, and session logs to researchers.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Palo Alto Networks Next-Generation Firewall Threat Prevention signatures
The article references specific Palo Alto Networks Advanced Threat Prevention signature IDs (e.g., 97030, 96882, 96855, 97044, 97046, 97251, 97177, 510019) that can help block the described attacks; no YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL rule bodies are published in the article itself. Cortex XDR/XSIAM and Cortex Xpanse are cited as providing broader detection/exposure-management coverage.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Exploitation largely targets internet-facing applications and occurs pre-endpoint compromise (scanning, exploit attempts); EDR would primarily have visibility if exploitation succeeded and led to post-exploitation activity (e.g., reverse shells, command execution) on a monitored host. |
| Network Visibility | High | The campaign relies heavily on network-based reconnaissance (FOFA scanning), HTTP-based exploitation attempts, proxy traffic to third-party relay infrastructure, and Telegram-based C2, all of which are observable via network traffic analysis, web/app firewall logging, and exposure management tools if visibility exists. |
| Detection Difficulty | Hard | The autonomous AI-driven reconnaissance and exploitation attempts blend into normal internet background scanning noise, use legitimate proxy/cloud infrastructure, and target unauthenticated/misconfigured application endpoints, making differentiation from routine internet scanning and legitimate research difficult without dedicated exposure management tooling. |
Required Log Sources
- Web application/reverse proxy access logs for exploit-related HTTP requests
- Firewall/IDS logs for FOFA scanning patterns and outbound connections to proxy/anti-attribution infrastructure
- Application-specific logs (Langflow, n8n, Citrix NetScaler, Tomcat, Marimo) for authentication and file upload activity
- EDR process execution and network connection logs for any successful post-exploitation shell activity
- Cloud/VPS provider logs if hosting internet-facing vulnerable applications
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for high-volume, rapid, sequential HTTP requests probing version and form endpoints across many hosts, which may indicate automated/AI-driven vulnerability scanning (T1595.002) rather than human-paced reconnaissance. | Web server / reverse proxy access logs, WAF logs | Reconnaissance | Medium - legitimate vulnerability scanners and internet researchers (e.g., Shodan/Censys-style crawlers) generate similar patterns. |
| Consider monitoring for unauthenticated file upload attempts or unusual form submissions to workflow automation or low-code platforms (e.g., n8n, Langflow), which may indicate exploitation attempts against chained CVEs. | Application logs, WAF logs | Initial Access / Exploitation | Low - legitimate users rarely submit unauthenticated forms with file uploads to these specific endpoints. |
| Consider reviewing outbound connections from internet-facing hosts to unfamiliar proxy or relay domains, which may indicate anti-attribution proxy usage by an attacker's AI tooling. | Firewall/proxy egress logs, DNS logs | Command and Control | Medium - proxy services are also used for legitimate purposes; requires correlation with other suspicious activity. |
| Consider investigating memory-read or out-of-bounds read exploitation attempts against Citrix NetScaler/ADC devices followed by searches for authentication cookie strings, which may indicate session hijacking intent. | NetScaler/ADC device logs, network IDS alerts | Credential Access / Exfiltration | Low - this specific pattern is unusual outside of exploitation attempts. |
| Consider monitoring for unexpected outbound HTTP file server processes started from unusual working directories on servers, which may indicate accidental exposure of attacker or automation tooling infrastructure. | Endpoint process execution logs, network connection logs | Operational Exposure | Medium - developers occasionally spin up temporary HTTP servers for legitimate testing purposes. |
Control Gaps
- Traditional signature-based detection is unlikely to catch AI-orchestrated reconnaissance and exploit selection since the underlying exploit code is often unmodified public PoC code.
- Standard perimeter defenses would not detect an attacker's use of legitimate AI platforms/APIs (DeepSeek, Qwen, etc.) as this traffic is indistinguishable from normal API usage without deep content inspection.
- Client-side execution restrictions (Claude Code, Codex safety settings) do not affect provider-side or self-hosted open-source frameworks like Hermes Agent, which has no built-in safety layer.
Key Behavioral Indicators
- Unusual high-velocity, low-dwell-time scanning behavior against internet-facing applications consistent with automated/AI-paced reconnaissance rather than manual attacker behavior
- Presence of exploit development or PoC directories marked as 'trusted' with broad read/write/execute permissions on developer or attacker-controlled hosts
- Outbound connections to third-party proxy relay infrastructure combined with AI coding tool configuration artifacts (e.g., permission-bypass flags)
- Search patterns for authentication cookie strings within exfiltrated memory or data dumps, suggesting session hijacking preparation
False Positive Assessment
Medium - while some behavioral indicators (rapid multi-host scanning, unauthenticated form submission attempts, cookie-string searches in exfiltrated data) are fairly specific, broader indicators like proxy usage or AI API traffic overlap significantly with legitimate research, scanning, and development activity, requiring correlation across multiple signals to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting: identify and patch internet-facing instances of Langflow, n8n, Citrix NetScaler/ADC, Apache Tomcat, Marimo Notebook, PAN-OS User-ID portal, and Windows IKE VPN components to the vendor-recommended fixed versions referenced for the CVEs in this report.
- Consider disabling or restricting public/unauthenticated access to workflow automation tool endpoints (e.g., n8n forms, Langflow flows) where not operationally required.
- If your environment exposes any of the named vulnerable products to the internet, consider conducting an urgent exposure assessment to confirm whether they are reachable and unpatched.
Infrastructure Hardening
- Evaluate whether attack surface management tooling can be used to continuously identify and alert on internet-exposed instances of the named vulnerable products.
- Consider enforcing authentication requirements by default on all form/upload endpoints in workflow automation platforms, rather than relying on optional configuration settings like auto_login.
- If applicable, review egress filtering rules to detect and flag unusual outbound connections to unfamiliar proxy/relay services that could indicate anti-attribution infrastructure abuse.
- Consider segmenting and monitoring any internal AI/LLM tooling infrastructure to prevent similar unintentional exposure of credentials or session data via misconfigured services (e.g., accidentally exposed file servers).
User Protection
- Where supported by your tooling, consider enabling behavioral threat protection and exploit prevention modules on endpoints hosting or interacting with the named vulnerable applications.
- Consider reviewing NetScaler/ADC session management and rotating authentication cookies/tokens if exposure to the described exfiltration technique is suspected.
- If your organization uses any of the affected products, consider verifying patch management processes prioritize critical CVSS 9.0+ vulnerabilities on internet-facing systems.
Security Awareness
- Consider briefing security and engineering teams on the emerging trend of AI-orchestrated autonomous exploitation, emphasizing that default/misconfigured settings (e.g., disabled authentication, enabled auto-login) can be rapidly identified and exploited at scale.
- Consider incorporating awareness of AI-enabled attacker tradecraft (autonomous reconnaissance, exploit sourcing, proxy anonymization) into existing threat intelligence briefings for technical staff.
- Evaluate whether internal policies around exposing development/testing tools (e.g., ad hoc HTTP file servers) to the internet need reinforcement, given this incident's root cause was an unintentional service exposure.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Reconnaissance
Tactic
Resource Development
Tactic
Initial Access
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
code[.]newcli[.]com- Anti-attribution proxy used to relay Claude Code and Codex sessions.
- Urls:
code.newcli.com/codex/v1- Proxy path for Codex access.code.newcli.com/ultra- Proxy path for Claude Code access.
- File Paths:
/home/worker- Actor's home directory used as workspace; accidentally exposed via an HTTP file server, revealing tool configs, API keys, exploit scripts, target lists and session logs.
- Command Lines:
- Purpose: Autonomous agent unintentionally started an HTTP file server in the operator's home directory, exposing the entire operational workspace to researchers. | Tools:
python3,Hermes Agent| Stage: Operational exposure / OPSEC failure |python3 -m http.server 8888 - Purpose: PoC scanner invocation to mass-check target lists for vulnerable Langflow instances. | Tools:
langflow_poc.py| Stage: Exploitation attempt |langflow_poc.py --scan-file langflow_targets.txt --threads 10
- Purpose: Autonomous agent unintentionally started an HTTP file server in the operator's home directory, exposing the entire operational workspace to researchers. | Tools:
- Other:
NSC_AAAC=- NetScaler authentication cookie name searched for in exfiltrated memory data, indicating session hijacking intent.qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC- GitHub repository cloned by the actor for CVE-2026-0300; PoC code was non-functional with placeholder values.Chocapikk n8n Ni8mare exploit repository- GitHub repository used to obtain the chained n8n exploit PoC for CVE-2026-21858/CVE-2025-68613.
