Unit 42 Names the Autonomous Toolchain: DeepSeek Run Through Hermes Over Telegram

The autonomous-agent campaign Unit 42 attributed to a Chinese-speaking operator last week now has a named toolchain — and it's the same open-source framework that ran the intrusion at Thailand's Ministry of Finance. In its writeup of Palo Alto Networks' Unit 42 research, The Hacker News identifies the reasoning model that drove the operation as DeepSeek, running inside the open-source Hermes Agent framework and commanded over Telegram. That makes this the second separate autonomous campaign disclosed this month to run on Hermes, and the first time the model, the command channel, and the operator's handles have all been put on the record in one place.

When The CyberSignal first covered Unit 42's disclosure, the tie to Hermes was reported but thin — a recurrence worth flagging, with the model and the mechanics unnamed. The new reporting fills that gap: DeepSeek as the primary reasoning model, Telegram as the control channel, an operator tracked through the aliases knaithe and KnYuan, and exploitation attempts against more than 460 targets. What it doesn't do is connect that operator to the one behind the Thai case. That gap is the part defenders should hold onto, not close.

One Framework, Two Campaigns

The reason to lead with Hermes rather than DeepSeek is that the framework is the recurring element. Over roughly two weeks, three CyberSignal briefs have circled the same open-source project from different angles: the first Thai Ministry of Finance disclosure, which established that an autonomous agent had done the legwork but left it unnamed; the follow-up that named Hermes and its "YOLO mode"; and Unit 42's account of a Chinese-speaking operator. The new reporting is what ties the third to the same framework as the first two.

Here's my read, labeled as such: the story is no longer "an AI agent was used in an attack." It's that a single freely downloadable agent framework is now the substrate under two distinct operations run by, as far as the public record shows, different people against different targets. Hermes supplies the terminal access, the reusable skills, and the unattended execution; the operator supplies a model and a target list. Once that pattern is the norm, "which agent" tells a defender less than "what was it pointed at, and how fast did it move."

What the New Reporting Names

Per The Hacker News, drawing on Unit 42's report, DeepSeek was the primary reasoning model inside Hermes, which supplied the execution scaffolding around it. Unit 42 found limited use of Claude Code and Qwen Code as well, and signs of Codex in exploit-development directories that it could not verify because the chat logs weren't preserved — so treat DeepSeek as the confirmed driver and the rest as reported traces, not co-equal tooling.

The command path is the detail worth sitting with. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits, and Unit 42 recovered no further operator input in that session. Hermes's own documentation confirms it can operate through Telegram, run commands, and schedule unattended tasks — so the control channel isn't an exotic build, it's a feature of the framework as shipped. The operator, tracked through the handles knaithe and KnYuan, launched exploitation attempts against more than 460 targets across both autonomous and conventional workflows.

The Agent Picked Its Own Targets

The recovered sessions read less like a script and more like a junior operator working a list. In a May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection flaw (CVE-2026-33017), enumerated 84 instances through the FOFA search engine, and found one running the vulnerable version 1.3.4. The attempt stopped there — the target had neither auto_login enabled nor a usable public flow identifier, so the exploit's preconditions weren't met.

What happened next is the part that should hold a defender's attention. The agent didn't stall. It surveyed roughly ten product families, searched GitHub for recent proof-of-concept repositories, and settled on n8n, the workflow-automation platform, obtaining a chain that combines an unauthenticated file-access flaw (CVE-2026-21858) with an expression-injection issue (CVE-2025-68613). FOFA returned 25,209 n8n systems in China during the session; DeepSeek sampled about 100, probed roughly 40, and identified three running vulnerable versions. All three required authentication on their form endpoints, and more than 50 other candidates lacked a usable public form, so no n8n system was compromised. Across the operation Unit 42 counted seven exploit tracks spanning eight CVEs, the extra identifier coming from that two-bug n8n chain.

The behavior — check versions, download an exploit, abandon an unproductive path, and choose the next target by severity, deployment scale, and apparent exploitability — is the capability defenders should internalize. It's not a novel exploit. It's public exploits, selected and sequenced without a human in the loop between the first instruction and the results.

How Much Damage, Actually?

This is where I'd flag the reporting as internally unresolved. Unit 42 describes separate, manually run operations that did land: data exfiltration from three organizations through the NetScaler memory-overread flaw CVE-2026-3055, and command execution on 11 Marimo instances through CVE-2026-39987. Yet the report elsewhere says it could confirm only three successfully exploited targets across the entire operation, and, as The Hacker News notes, it doesn't reconcile the two statements. The Hacker News says it has asked Palo Alto Networks for clarification. Until that lands, the honest summary is: the DeepSeek-driven attempts against Langflow and n8n failed on configuration grounds, some manual operations succeeded, and the exact confirmed-impact number is contested in the source itself. I wouldn't build a headline on "460 targets" — that's attempts, not compromises.

The Same Self-Own That Exposed Thailand

The campaign is visible at all because of an operator mistake that rhymes with the Thai case. According to Unit 42, Hermes exposed the operation by starting a Python HTTP server (python3 -m http.server 8888) from /home/worker. That unintended server made the actor's model configurations, API keys, exploit scripts, target lists, shell history, and autonomous-session logs reachable. The Thai disclosure surfaced the same way — through operator infrastructure left exposed, not through a defender's detection.

My assessment: that's a thin thread to lean on. Two autonomous operations became public because their operators fumbled their own opsec, which means the disclosure rate we're seeing is partly a function of operator sloppiness, not defender visibility. A more careful operator running the same framework would leave far less behind. Read the current cluster as a floor on this activity, not a census of it.

What Defenders Should Watch

The concrete work splits into patching and pattern-recognition.

On patching, the exposed products have fixes. Langflow addressed CVE-2026-33017 in version 1.9.0. For n8n, version 1.121.1 is the earliest release that closes both flaws in the attempted chain. Marimo fixed CVE-2026-39987 in 0.23.0. And CVE-2026-3055 affects customer-managed NetScaler ADC and Gateway appliances configured as SAML identity providers — administrators can check the configuration for add authentication samlIdPProfile and apply Citrix's fixed builds. Unit 42's broader guidance is to remove unnecessary public access to workflow and notebook interfaces, which is what turned exposed Langflow, n8n, and Marimo instances into candidates in the first place.

On patterns, three signals are worth building awareness around now. First, DeepSeek paired with a Telegram command channel: an inexpensive reasoning model plus a consumer messaging app as the operator's control plane is a low-cost, low-friction setup, not a bespoke toolchain. Second, autonomous public-exploit selection: activity that enumerates hosts through services like FOFA, pulls proof-of-concept code from GitHub, tries a target, and pivots to the next candidate at machine speed — too fast and too uniform to be hand-driven. Third, and hardest, the attribution problem the open-source framework creates. When the agent is a downloadable project pointed at an operator's choice of model, there's no vendor chokepoint to throttle it and no single provider log to subpoena. That's the same open-source-versus-proprietary distinction that ran through the Thai coverage, and it cuts directly against fast attribution.

Open Questions

The largest open question is whether this operator and the one behind the Thai intrusion are the same, related, or simply two independent users of the same public tool. The reporting does not connect them, and neither does The CyberSignal — a shared framework is a shared framework, not a shared actor.

Attribution beyond the keyboard is also unsettled, and deliberately so. Unit 42 assesses the operator to be based in Zhuhai, China: the GitHub profile displays the name "KnYuan Knaithe," and an older blog under the same handle describes its author as a binary-security researcher in Zhuhai. Unit 42 is clear that this public material is consistent with, but does not independently verify, the assessment, and that none of it establishes the operator's legal identity or any state connection. The source's language is "Chinese-speaking," and that's where it should stay — not "state-backed." The confirmed-impact discrepancy in the report is the other loose thread; a clarification from Palo Alto Networks would settle how many targets were actually compromised versus merely attempted. This piece is a follow-up to a still-developing disclosure, and where it says "reportedly," the confirming detail isn't yet in hand.

For the wider arc this sits inside — including the two frontier-lab self-disclosures that bookended the month — see The CyberSignal's reporting on Anthropic's Claude models breaching three real organizations during safety tests.

Primary Documents

• Unit 42 (Palo Alto Networks) — report on the autonomous AI cyber-attack campaign
• The Hacker News — Chinese-speaking actor commands DeepSeek via Telegram to launch autonomous attacks
• Hermes Agent — framework documentation (Nous Research)