DeepSeek Steered via Telegram: An AI Agent Attacked Hundreds of Systems With Almost No Operator

Palo Alto Networks' Unit 42 has reported a cyber campaign in which a Chinese-speaking threat actor used the DeepSeek model inside the open-source Hermes Agent framework to carry out attacks autonomously. According to the researchers, after a single instruction issued through Telegram, the agent independently located internet-facing systems and selected public exploits — no further operator commands were found in the recovered session.

The threat actor, tracked under the aliases knaithe and KnYuan, made exploitation attempts against more than 460 targets, combining autonomous and conventional methods. Unit 42 identified seven attack strands spanning eight CVE identifiers. The report does contain an internal contradiction, however: it states that data was exfiltrated from three organizations via a NetScaler vulnerability (CVE-2026-3055) and that commands were executed on 11 Marimo instances (CVE-2026-39987), but then says that only three targets could be confirmed as successfully compromised. The publication The Hacker News has requested clarification from the company.

How the agent operated

In a recovered May session, DeepSeek downloaded a public exploit for a code-injection vulnerability in Langflow (CVE-2026-33017), used the FOFA search engine to find 84 instances, and identified one running the vulnerable version 1.3.4. The attack failed: the system did not have auto_login enabled or a usable public flow identifier. The agent then surveyed ten product families, searched GitHub for fresh PoC repositories, and pivoted to the automation platform n8n, assembling a chain of two vulnerabilities. FOFA returned more than 25,000 n8n systems in China; from a sample of about a hundred, the agent checked roughly forty and found three vulnerable versions — but here too, every accessible endpoint required authentication, so no system was breached.

Notably, the agent behaved like an analyst: it checked versions, downloaded exploits, abandoned a dead-end path, and picked the next target based on the severity of the vulnerability, the scale of its deployment, and its likely exploitability.

The agent gave itself away

The operation was exposed by the tooling's own carelessness: from the /home/worker directory, Hermes Agent launched a simple web server with the command python3 -m http.server 8888. This inadvertently exposed HTTP server laid open to outsiders the model configurations, API keys, exploit scripts, target lists, shell history, and autonomous-session logs.

The primary “reasoning” model was DeepSeek, which provided terminal access and uncontrolled task execution; Claude Code and Qwen Code were used to a lesser extent. Unit 42 assesses that the operator is based in Zhuhai, though public data neither confirms this nor establishes the operator's identity or any link to a state.

Organizations are advised to update internet-facing Langflow, n8n, and Marimo systems, as well as NetScaler ADC/Gateway devices configured as SAML providers, and to remove unnecessary public access to workflow and notebook interfaces.

Source: The Hacker News