Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Summary

Unit 42 documented an AI-enabled autonomous hacking campaign by a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan. The actor combined autonomous AI-driven enumeration and exploitation with manual conventional operations, engaging seven vulnerabilities against internet-exposed infrastructure. DeepSeek, driven through the open-source Hermes Agent framework and commanded over Telegram, served as the autonomous operator that enumerated targets via FOFA, sourced public exploit code, and launched attacks without human intervention.^[0][10]

Unit 42 gained unique insight when the agent inadvertently started a file server in the actor's home directory, exposing the full operational environment: AI tool configurations, exploit tooling, targeting, and autonomous session logs. The recovered logs show the agent attempting to exploit Langflow (CVE-2026-33017), then autonomously surveying product families and trending GitHub PoCs to pivot to a higher-value n8n exploit chain (CVE-2026-21858 / CVE-2025-68613); both autonomous attempts failed due to target-side configuration and authentication requirements.^{[0][17][18][20][21][22]}

The actor also ran manual campaigns with confirmed impact, exfiltrating data from three organizations via a Citrix NetScaler vulnerability (CVE-2026-3055). The actor selected DeepSeek—a model with no built-in safety layer—for autonomous use within the Hermes framework, a self-hosted approach that contrasts with Anthropic's November 2025 disclosure of Chinese state-sponsored abuse of vendor-hosted Claude Code, where the vendor could ban accounts.^[0][25][47]

Attack chain

1. Phase 1: Langflow exploitation attempt (autonomous): DeepSeek identified CVE-2026-33017 (Langflow, CVSS 9.8), downloaded the public PoC from GitHub, enumerated 84 Langflow instances via FOFA (title="Langflow"), ran the PoC scanner, and identified one vulnerable target (Langflow 1.3.4). Exploitation failed because the target lacked auto_login and a public flow ID; the agent assessed the product family as a low-value target.^[0][17][18]
2. Phase 2: Autonomous CVE research and target selection: After abandoning Langflow, DeepSeek surveyed deployment counts across 10 product families via FOFA and searched GitHub for trending 2026 CVE PoC repositories sorted by stars, evaluating candidates by severity, footprint, and exploitability before selecting n8n (258-star PoC, CVSS 10.0). FOFA confirmed 647,017 n8n instances globally and 25,209 in China.^[0]
3. Phase 3: n8n exploit acquisition: DeepSeek obtained the public n8n PoC from the Chocapikk repository, which chains CVE-2026-21858 (arbitrary file read, CVSS 10.0) and CVE-2025-68613 (sandbox bypass to RCE, CVSS 9.9), requiring an unauthenticated form with file upload. The agent analyzed affected version ranges, noting v1.117.3 was vulnerable to both.^{[0][20][21][22]}
4. Phase 4: n8n target enumeration and exploitation attempts: DeepSeek ran FOFA queries against Chinese n8n instances and probed targets for version and form endpoints, confirming three vulnerable versions (v1.18.0, v1.117.3, v1.108.2). All discovered form endpoints required authentication, so no exploitation was achieved and recovered session data ends here.^[0]
5. Manual exploitation (separate workflow): Using conventional FOFA enumeration, custom Python scanners, and direct exploitation, the actor exfiltrated data from three organizations via a Citrix NetScaler vulnerability (CVE-2026-3055), with additional manual command-execution activity reported.^[0][25]

Disclosure timeline

Actor profile

knaithe / KnYuan

A Chinese-speaking, opportunistic exploit operator who assembled an integrated AI offensive environment: DeepSeek driven through the Hermes Agent framework with custom red-teaming skills (godmode jailbreaking, web-terminal-exploitation, fofa-cyberspace-search), a FofaMap MCP server, Telegram command-and-control, and proxy anonymization for Western tools. The actor evaluated multiple Chinese-market LLMs (Qwen, GLM, Kimi, MiniMax) and tested Western tools (Claude Code, Codex) in limited fashion, consistent with assessing the AI market for a preferred toolset. The actor showed OPSEC awareness—disabling Codex response storage and enabling anti-attribution headers—yet inadvertently exposed the entire workspace via a file server started in the home directory.^[0][15]

How it works

The autonomous engine used DeepSeek as the reasoning model within the Hermes Agent framework, which provided terminal access, Telegram command-and-control, and a skills system with no built-in safety layer. The actor added custom red-teaming skills: a framework-bundled 'godmode' LLM-jailbreaking skill, a custom 'web-terminal-exploitation' skill for unauthenticated WebSocket exploitation, and a 'fofa-cyberspace-search' skill invoking the actor's fofoapi.py for internet asset enumeration. The actor also integrated the open-source FofaMap MCP server exposing FOFA search, Nuclei scan generation, and a DeepSeek-powered natural-language-to-FOFA translator.^[0][15][16]

The actor deliberately configured tools to reduce restrictions and traceability: Claude Code with dangerously-skip-permissions and 12 allowlisted tools plus anti-attribution headers (CLAUDE_CODE_ATTRIBUTION_HEADER "0", CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC "1"), Codex with disable_response_storage = true and network access enabled, and Qwen Code in 'yolo' approval mode. Western tools were routed through the code.newcli[.]com proxy; DeepSeek and Qwen were accessed directly via their native API endpoints. Removing client-side execution permissions does not affect provider-side controls for vendor-hosted platforms.^[0][14]

The n8n exploit chained CVE-2026-21858 (arbitrary file read, CVSS 10.0, patched in 1.121.0) and CVE-2025-68613 (sandbox bypass to RCE, CVSS 9.9, patched in 1.120.4), and required an unauthenticated form with file upload—so authenticated form endpoints defeated the attempt. The Langflow flaw CVE-2026-33017 (CVSS 9.8) required either auto_login enabled or a public flow ID, neither of which the target had. Confirmed manual impact came from CVE-2026-3055, a Citrix NetScaler flaw used to exfiltrate data from three organizations.^{[0][17][18][20][21][22][23][24][25]}

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Autonomous AI-driven attack cycles are operationally viable end-to-end—the agent discovered, assessed, pivoted, and retargeted without human intervention; the margin of failure here hinged on target-side configuration rather than any defensive detection.^[0]
• Threat actors follow the path of least resistance in model choice: this actor selected DeepSeek within a framework with no built-in safety layer for autonomous use and only tested Western tools in limited fashion, contrasting with the vendor-oversight model in Anthropic's November 2025 Claude Code disclosure.^[0][47]
• Autonomous AI execution introduces novel OPSEC risk for attackers: the same automation that enabled the campaign caused its exposure when the agent started a file server in the home directory, producing forensic artifacts that manual execution would not have generated.^[0]

Defensive actions

• Harden and patch internet-exposed Langflow, n8n, and Citrix NetScaler deployments, and remove weak default configurations such as auto_login or public flow IDs and unauthenticated form endpoints.: Autonomous exploitation was prevented only by target-side requirements (absence of Langflow auto_login/public flow ID, authentication on n8n form endpoints); weaker-configured targets would have been susceptible, and confirmed impact came via Citrix NetScaler CVE-2026-3055.^[0][25]
• Prioritize n8n upgrades to at least 1.121.0 (CVE-2026-21858) and 1.120.4 (CVE-2025-68613) and remediate CVE-2026-33017 and CVE-2026-3055.: The actor maintained active exploit tooling for these vulnerabilities across autonomous and manual workflows, achieving confirmed impact on some.^{[0][17][20][21][22][23][24][25]}
• Block or scrutinize traffic to anonymizing proxies such as code.newcli[.]com and treat self-hosted, permission-stripped AI agents (e.g., Hermes with DeepSeek) as an operational risk while monitoring attack-surface exposure.: The actor deliberately selected a model with no built-in safety layer in a framework with no client-side restrictions and routed Western tools through a proxy to evade attribution; provider-side controls do not apply to self-hosted models.^[0]