Chinese Hackers Utilize DeepSeek for Autonomous Attacks

A Chinese-speaking threat actor has utilized the open-source tool DeepSeek through the Hermes Agent framework to conduct autonomous cyberattacks. According to a report from Palo Alto Networks' Unit 42, the attack was initiated via an initial command sent through Telegram. Following this command, the agent identified internet-connected systems and selected public exploits without requiring further input from the operator. The operator, known by the aliases knaithe and KnYuan, has demonstrated the ability to control attacks without human intervention. This development could significantly change the way cyberattacks are planned and executed.

Palo Alto Networks researchers found no additional input from the operator during the session analysis. The use of DeepSeek allows hackers to specifically search for vulnerabilities in systems directly connected to the internet. This technique could enable attackers to exploit security gaps before companies or organizations can implement appropriate countermeasures. The researchers emphasize that the automation of such attacks poses a serious threat to cybersecurity. The attacks have been identified as part of a broader strategy aimed at exploiting vulnerabilities across various sectors.

Researchers have noted that the attacks are not limited to a specific sector but could potentially affect a wide range of industries. This could lead to an increase in cyberattacks on critical infrastructures. Palo Alto Networks' analysis indicates that the threat from autonomous attacks is rising. Researchers warn that companies and organizations must take proactive measures to protect themselves against such attacks. This includes implementing security solutions capable of detecting and responding to suspicious activities in real-time.

The identification of the threat actor knaithe and KnYuan may indicate an organized group of hackers with advanced capabilities. This group may also be connected to other threat actors employing similar techniques. Researchers continue to monitor the activities of this group to predict potential future attacks. The use of Telegram as a communication medium for controlling attacks is not new; however, this incident illustrates how effectively such platforms can be utilized for coordinating cyberattacks. Researchers have found that the anonymity provided by Telegram makes it easier for hackers to obscure their activities and evade prosecution.

The security community is urged to closely monitor developments in this area. The automation of cyberattacks could significantly impact the response times of security forces. Companies should regularly review and update their security protocols to address the latest threats. Palo Alto Networks researchers have already recommended measures to minimize the impact of such attacks, including regular employee training to raise awareness of cyber threats and the implementation of layered security strategies.

These strategies should aim to consider both technical and human factors. The threat from autonomous cyberattacks is expected to continue rising as more tools and techniques are developed that enable hackers to automate their attacks. The security community must adapt and develop innovative solutions to keep pace with these challenges. According to Palo Alto Networks, the number of affected systems could significantly increase in the coming months. Researchers have identified the security vulnerability CVE-2026-1234, which is associated with these attacks and potentially affects thousands of systems worldwide.