DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection

Source: dev.to · Published: 2026-08-01

<h1> DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection </h1>

<h2> 1. Basic Information </h2>

<ul> <li> <strong>Article Title</strong>: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks</li> <li> <strong>Publisher</strong>: Unit 42</li> <li> <strong>Publication Date</strong>: 2026-07-30</li> <li> <strong>Severity</strong>: High</li> <li> <strong>Original Source</strong>: <a href="https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/" rel="noopener noreferrer">https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/</a> </li> <li> <strong>Related Malware</strong>: Hermes Agent, FofaMap MCP, Nuclei</li> <li> <strong>Threat Group</strong>: knaithe / KnYuan (Chinese-speaking threat actor)</li> <li> <strong>CVEs</strong>: CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824</li> <li> <strong>Products & Environments</strong>: Langflow, n8n, Citrix NetScaler, Marimo, Apache Tomcat, Windows IKE</li> </ul>

<h3> Related Sources </h3>

<ul> <li><a href="https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/" rel="noopener noreferrer">BleepingComputer Coverage</a></li> </ul>

<h2> 2. Executive Summary </h2>

<p>Given a single goal via Telegram, the Hermes/DeepSeek combination autonomously executed FOFA enumeration, PoC acquisition, success condition evaluation, and even switched to a different product after a failure.</p>

<h2> 3. Attack Flow </h2>

<h3> Autonomous Langflow to n8n Pivot </h3>

<ol> <li>The operator gave an initial task to Hermes via Telegram.</li> <li>DeepSeek enumerated 84 Langflow instances on FOFA and downloaded the CVE-2026-33017 PoC from GitHub.</li> <li>It identified one instance as a vulnerable version, but the attack failed because it lacked <code>auto_login</code> or a public flow ID.</li> <li>It compared the public exposure scale of 10 product groups with GitHub PoC star counts and CVSS scores, then autonomously pivoted to n8n.</li> <li>It analyzed the chain of CVE-2026-21858 (file read) and CVE-2025-68613 (RCE).</li> <li>It found 3 vulnerable versions, but the attack failed because the unauthenticated file-upload form was missing.</li> </ol>

<h3> Parallel Manual Campaign </h3>

<ol> <li>The attacker enumerated public devices using FOFA and a custom scanner.</li> <li>They read NetScaler memory for 3 organizations using CVE-2026-3055 and searched for the <code>NSC_AAAC</code> cookie.</li> <li>They confirmed command execution on 11 Marimo notebooks using CVE-2026-39987.</li> <li>They attempted reverse shells against Tomcat and IKE VPN.</li> </ol>

<h2> 4. Attacker Infrastructure and Execution Environment </h2>

<ul> <li> <strong>Attacker Infrastructure</strong>: Publicly exposed attack server on <code>/home/worker</code>, Telegram C2, and third-party proxies.</li> <li> <strong>AI Execution</strong>: Hermes Agent provided terminals, skills, and MCP, while DeepSeek handled reasoning and decision-making.</li> <li> <strong>Targets</strong>: Publicly exposed Langflow, n8n, NetScaler, Marimo, Tomcat, and IKE endpoints.</li> </ul>

<h2> 5. Visibility for Victims and Administrators </h2>

<h3> Victims and End Users </h3>

<ul> <li>Autonomous attacks require no user interaction. Fast version probes, scanning, and PoC requests arrive at public services.</li> <li>Contact traces for version enumeration and scanning remain even on targets where the exploit fails.</li> </ul>

<h3> Administrators and SOCs </h3>

<ul> <li>Product-specific probes, known PoC patterns, and rapid target switching from the same source IP.</li> <li>Repeated requests after NetScaler memory reads, Marimo command execution, and reverse shell callbacks.</li> </ul>

<h2> 6. Success and Failure Conditions </h2>

<h3> Success Conditions </h3>

<ul> <li>Target services are publicly accessible and running vulnerable versions.</li> <li>Prerequisites are met: Langflow requires <code>auto_login</code> or a public flow ID; n8n requires an unauthenticated file-upload form.</li> <li>PoC acquisition, execution, and egress/reverse shells are not blocked.</li> </ul>

<h3> Failure Conditions </h3>

<ul> <li>Required workflows or forms are private or require authentication.</li> <li>The target runs a vulnerable version, but configuration prerequisites are not met.</li> <li>Attack surface reduction, patching, WAF/IPS, and egress filtering block the PoC or callback.</li> <li>AI provider safety controls or tool permissions block the attack actions.</li> </ul>

<h2> 7. What Happens on Success </h2>

<ul> <li>Full compromise was not confirmed in the autonomous campaign, and Langflow/n8n attempts failed.</li> <li>In the manual campaign, data exfiltration was confirmed from 3 NetScaler devices, and command execution was confirmed on 11 Marimo instances.</li> <li>NetScaler cookie searches indicate intent to hijack sessions.</li> <li>AI compressed hundreds of hours of target selection down to a few minutes, amplifying the speed and scale of attack attempts.</li> </ul>

<h2> 8. Observable Logs </h2>

<h3> Email </h3>

<ul> <li>No direct email vectors.</li> </ul>

<h3> Proxy / SWG / DNS </h3>

<ul> <li>FOFA/API queries, GitHub PoC downloads, <code>api.deepseek.com</code>, Telegram traffic, <code>code.newcli.com</code>, and <code>curl</code>/HTTP probes targeting the victims.</li> </ul>

<h3> Endpoint / EDR </h3>

<ul> <li>On the attacker side: Hermes, <code>fofoapi.py</code>, Nuclei, PoC scripts, and <code>python3 -m http.server 8888</code>. On the victim side: Shells or <code>curl</code> spawned by service processes.</li> </ul>

<h3> Identity / IdP </h3>

<ul> <li>Unauthorized use of NetScaler <code>NSC_AAAC</code> cookies and abnormal sessions on public management interfaces.</li> </ul>

<h3> SaaS / Cloud </h3>

<ul> <li>Langflow/n8n/Marimo audit logs, GitHub PoC downloads, and AI API/tool-call logs.</li> </ul>

<h3> Network </h3>

<ul> <li>High volume of targets in a short time, version/form endpoint probes, reverse shell callbacks, and repeated out-of-band memory-read requests.</li> </ul>

<h2> 9. Attack Success Determination </h2>

<ul> <li> <strong>Contact Only</strong>: FOFA inclusion or HTTP probes.</li> <li> <strong>User Interaction</strong>: None required.</li> <li> <strong>Initial Execution</strong>: Commands or shells spawned from service processes.</li> <li> <strong>Malware or Auth Success</strong>: Reverse shell connection established, or session established using stolen cookies.</li> <li> <strong>Data Theft</strong>: NetScaler memory responses and external data staging confirmed.</li> <li> <strong>Post-Compromise</strong>: Session reuse, internal reconnaissance, and persistent access confirmed.</li> </ul>

<h2> 10. Investigation Playbook </h2>

<ul> <li> <strong>Trigger</strong>: PoC-style probes against public AI/workflow products, NetScaler memory reads, or Marimo child shells.</li> <li> <strong>Initial Verification</strong>: Check products, versions, configuration prerequisites, source IPs, request bodies, and response sizes.</li> <li> <strong>Endpoints</strong>: Collect service child processes, temp files, shell history, new accounts, and web shells.</li> <li> <strong>Authentication & Cloud</strong>: Revoke NetScaler cookies and rotate workflow secrets and API keys.</li> <li> <strong>Subsequent Operations</strong>: Scan all public assets for the same source IP and PoC URI, and check for egress callbacks and cookie usage.</li> <li> <strong>Containment</strong>: Take services offline, apply patches, enforce form authentication, rotate secrets, and rebuild compromised hosts.</li> <li> <strong>Classification</strong>: Recon / Exploit Attempt Failed / Code Execution / Session Theft / Exfiltration / Post-compromise.</li> </ul>

<h2> 11. Defense and Detection Ideas </h2>

<ul> <li> <strong>Single Indicators</strong>: Shells spawned from public services, known PoC URIs, and abnormally large NetScaler responses.</li> <li> <strong>Correlated Indicators</strong>: Version probe -> PoC download pattern -> exploit request -> service child process -> callback.</li> <li> <strong>Threat Hunting</strong>: Inventory not only vulnerable versions but also success prerequisites such as <code>auto_login</code> and public forms.</li> <li> <strong>Log Gaps</strong>: Full WAF request logs, service audit logs, process lineage, NetFlow/egress logs, and AI agent tool logs.</li> <li> <strong>Prioritized Mitigations</strong>: Reduce attack surfaces using ASM, apply rapid patches, enforce workflow authentication, block egress traffic, and shorten secret lifespans.</li> </ul>

<h2> 12. Facts, Inferences, and Hypotheses </h2>

<h3> Facts </h3>

<ul> <li>Hermes/DeepSeek performed FOFA enumeration, PoC acquisition, success condition evaluation, and pivoting to n8n within a single session.</li> <li>Autonomous exploits against Langflow and n8n failed because configuration prerequisites were not met.</li> <li>The threat actor targeted over 460 assets.</li> <li>Manual activities confirmed data exfiltration from 3 NetScaler devices and command execution on 11 Marimo instances.</li> <li>Hermes started an HTTP server on <code>/home/worker</code>, exposing the attacker's tools, API keys, and logs.</li> </ul>

<h3> Inference </h3>

<ul> <li>For SOCs, the novelty is not a brand-new TTP, but rather the speed of selecting and iterating known PoCs, combined with autonomous target switching.</li> <li>Controls are needed not only on AI provider safety measures, but also on agent network/tool permissions and public asset configurations.</li> </ul>

<h3> Hypothesis </h3>

<ul> <li>If similar agents are parallelized across multiple workers, the time window between public PoC release and actual exploitation will shrink even further.</li> </ul>

<h2> 13. MITRE ATT&CK Mapping </h2>

<ul> <li> <strong>T1595.002 – Vulnerability Scanning</strong> (Confidence: High)</li> <li> <strong>T1588.005 – Obtain Capabilities: Exploits</strong> (Confidence: High)</li> <li> <strong>T1190 – Exploit Public-Facing Application</strong> (Confidence: High)</li> <li> <strong>T1059 – Command and Scripting Interpreter</strong> (Confidence: High)</li> <li> <strong>T1539 – Steal Web Session Cookie</strong> (Confidence: High [Manual phase])</li> <li> <strong>T1041 – Exfiltration Over C2 Channel</strong> (Confidence: Medium)</li> </ul>

<h2> 14. Unknowns and Further Investigation </h2>

<ul> <li>Full list of batch targets and additional victims.</li> <li>Proportion of exploit code generated or modified by AI.</li> <li>Final use of the stolen NetScaler data.</li> <li>Future successful cases of autonomous attacks.</li> <li>Detection of contacts against local public assets.</li> </ul>

<h2> 15. Impact on SOCs and Organizations </h2>

<p>Organizations worldwide increasingly expose tools like n8n, Langflow, AI notebooks, and ADCs/VPNs. Security teams must map not just vulnerability numbers, but also success prerequisites like public forms and auto-login into ASM/CMDB tools, and shorten remediation SLAs anticipating automated scans shortly after PoC publication.</p>

<h2> 16. Summary by Target Audience </h2>

<h3> For SOC Teams </h3>

<p>Separate mere scans from successful exploits. Correlate events from service child processes and callbacks to cookie usage.</p>

<h3> For Administrators </h3>

<p>Inventory public AI and workflow products, apply patches, enforce authentication, implement egress filtering, and rotate secrets.</p>

<h3> For End Users </h3>

<p>Be aware of server-side attacks that require no user interaction. Do not rely solely on self-recovery when anomalies or outages occur; preserve logs and report incidents immediately.</p>