Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Executive Summary

Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.

The actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator. They orchestrated this operator via Telegram for the following activities:

• Independently enumerating targets and their vulnerabilities using FOFA
• Sourcing exploit tools
• Initiating attacks without human intervention

In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax). We also identified limited usage and testing of Western platforms. This includes Claude Code for connectivity testing and proxy validation. There were also signs of usage of Codex on exploit development directories. This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.

When initial exploitation failed due to the target environment's restrictive configurations, their Hermes Agent autonomously conducted searches for known critical-severity Common Vulnerabilities and Exposures (CVEs). It initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface. This research led the agent to pivot to higher-value vulnerabilities, the seven covered in Table 2 below. While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability.

Palo Alto Networks customers are better protected from the threats described here through the following products and services:

• Cortex XDR and XSIAM
• Cortex Xpanse
• Next-Generation Firewall with Advanced Threat Prevention

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Technical Analysis

We gained unique insights into this autonomous attack capability when the autonomous agent inadvertently exposed its infrastructure by starting a file server in its home directory. This revealed the full operational environment to our threat researchers.

This visibility enabled us to understand their full tool set, how the attackers orchestrated multiple AI platforms and gave us a peek into their targeting. Based on our analysis of their session logs and configuration files, the actor primarily used the Hermes Agent with DeepSeek as its reasoning agent for the attack phase of this campaign. Their Hermes Agent conducted autonomous vulnerability enumeration, downloaded public exploit code from the internet and attempted exploits against targets.

Additionally, the threat actor leveraged the following tools in a limited capacity, likely indicating an ongoing assessment of the AI market for their use cases:

• Claude Code: The actor only used this for connectivity testing and proxy validation. Session history (10 entries across three sessions) contained only /model checks, connectivity tests and one npm install request.
• Codex: There were signs of usage on exploit development directories, but the chat logs were not preserved. The actor marked their exploit development directories as trusted, granting full access to read, modify and execute code. Although we cannot verify actual usage because the actor configured their system to limit local response storage (disable_response_storage = true), the correlation between trusted directories and successful campaigns is notable.
• Qwen Code: There was minimal usage by the actor, including two sessions total. They configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax), consistent with evaluating Chinese-market AI models.

Tool Configuration and Proxy Infrastructure

The actor configured four AI coding tools to remove client-side execution permissions. Note, this does not impact server-side controls for vendor-hosted platforms. They routed the two Western tools, Claude Code and Codex, through a third-party proxy service (code.newcli[.]com) to reduce traceability. The actor accessed DeepSeek and Qwen directly through their native API endpoints.

The actor enabled anti-attribution settings on both tools. The actor configured Claude Code with CLAUDE_CODE_ATTRIBUTION_HEADER: "0" and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", while they set Codex to disable_response_storage = true to limit response storage. Unit 42 did not recover any Codex chat logs from the exposed server. Note: This setting does not impact the retention of logging or safety signals in OpenAI’s safety systems.

Table 1 summarizes each tool's configuration.

Table 1. AI tool configurations.

DeepSeek/Hermes Agent — Autonomous Attack Cycle

DeepSeek, operating through the Hermes Agent framework, served as the actor's primary offensive AI tool. Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.