Listen to this Post
Introduction
The democratization of artificial intelligence has reached an ominous milestone: Chinese state-linked hacking groups have more than doubled their cyberattack volume after integrating inexpensive, open-source AI models into their operational workflows. Researchers from TeamT5 and Palo Alto Networks’ Unit 42 have documented how threat actors—operating under aliases such as knaithe, KnYuan, Grimfengxi, Huapi, and Teleboyi—are leveraging DeepSeek and other Chinese AI models to automate reconnaissance, generate exploit code, map targets, and develop sophisticated malware with minimal human intervention. This development represents a fundamental shift in offensive cyber operations: AI is no longer a theoretical enhancement but an operational weapon system that lowers the barrier to sophisticated cyberattacks while dramatically scaling their volume and speed.
Learning Objectives & Secrets
- Objective 1: Understand the AI-Powered Attack Kill Chain—Master how threat actors integrate DeepSeek with the Hermes Agent framework to automate target enumeration, vulnerability assessment, exploit selection, and attack execution across the entire intrusion lifecycle. Secret tip: The most dangerous aspect is the AI’s ability to autonomously pivot between targets—when one vulnerability proves ineffective, DeepSeek independently researches alternative CVEs, re-prioritizes targets, and launches new attack vectors without human direction.
-
Objective 2: Identify and Mitigate AI-Driven Reconnaissance Techniques—Learn how attackers weaponize FOFA (an IoT search engine) through MCP servers to scan for internet-exposed systems, then use DeepSeek to analyze deployment scale and vulnerability severity before selecting prime targets. Secret tip: Threat actors are testing multiple LLMs (Qwen, GLM, Kimi, MiniMax) while specifically choosing DeepSeek because Western models like Claude and OpenAI have provider-side safeguards that block offensive requests—making the absence of guardrails an offensive capability selector.
-
Objective 3: Defend Against Autonomous Exploitation Chains—Deploy defensive strategies against AI agents that chain multiple vulnerabilities together, such as CVE-2026-21858 (CVSS 10.0 arbitrary file read) combined with CVE-2025-68613 (CVSS 9.9 sandbox escape) to achieve remote code execution. Secret tip: In documented campaigns, autonomous attacks failed not because of AI limitations but because targets required specific configurations (e.g., `auto_login` enabled or authenticated form endpoints)—meaning that proper security hardening remains an effective defense even against AI-driven threats.
You Should Know
1. The Hermes Agent + DeepSeek Attack Pipeline
The most documented autonomous attack campaign involves a Zhuhai-based threat actor who wired DeepSeek into the open-source Hermes Agent framework—a tool that provides terminal access, Telegram-based command and control, and a skills system. The actor customized Hermes Agent with three red-teaming skills: a FOFA cyberspace search skill for internet asset enumeration, a “godmode” LLM jailbreak, and a WebSocket exploitation skill.
Step-by-Step Guide to Understanding the Attack Flow:
- Initial Command: The attacker sends an instruction via Telegram to the Hermes Agent.
- Target Enumeration: DeepSeek uses the FOFA MCP server to scan for internet-exposed systems. In one session, it identified 25,209 vulnerable n8n instances in China alone.
- Vulnerability Research: The AI searches GitHub for trending proof-of-concept exploits, evaluating them by severity (CVSS scores) and deployment scale.
- Exploit Selection & Download: DeepSeek selects an exploit chain—for example, CVE-2026-21858 and CVE-2025-68613—and downloads public exploit code.
- Autonomous Attack: The agent launches attacks without human intervention, probing targets and assessing results.
Linux Command to Detect FOFA-Style Scanning:
Monitor for suspicious mass-scanning patterns targeting your external IP ranges
sudo tcpdump -i eth0 -1n 'host <YOUR_EXTERNAL_IP> and (tcp[bash] & tcp-syn != 0)' | \
awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -1r | head -20
Check for unusual outbound connections to known FOFA API endpoints
sudo netstat -tunap | grep -E "(fofa|zoomeye|shodan)" | awk '{print $5}'
Windows PowerShell Command for Similar Detection:
Monitor for suspicious network connections
Get-1etTCPConnection | Where-Object {$_.State -eq "Established"} |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
Check for unusual DNS queries
Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" |
Where-Object {$_.Message -match "fofa|zoomeye|shodan"} |
Select-Object TimeCreated, Message
2. Why DeepSeek Became the Preferred Attack Engine
According to Charles Li, chief analyst at TeamT5, “DeepSeek is the AI of choice for Chinese hackers because it’s relatively powerful with very low cyber guardrails. Western models are highly sought-after but their guardrails are much more strict and require a lot more effort to bypass”. The threat actor tested Claude Code, Codex, Qwen, GLM, Kimi, and MiniMax—but specifically selected DeepSeek because it lacked restrictive safety layers. Western tools were routed through anti-attribution proxies with attribution headers stripped, while DeepSeek connected directly to its native API with no such precautions.
Step-by-Step Guide to Securing AI API Access:
- Implement API Key Rotation: Regularly rotate API keys and monitor for unauthorized usage.
- Deploy AI Firewalls: Use tools like ProtectAI or CalypsoAI to inspect prompts and responses for malicious patterns.
- Enable Provider-Safe Guardrails: When using commercial AI APIs, enable all available safety filters and content moderation layers.
- Monitor for LLMjacking: Watch for unusual API consumption patterns that may indicate stolen credentials.
Linux Command to Monitor API Key Usage:
Monitor for unusual outbound API traffic patterns
sudo tcpdump -i any -A -s 0 'port 443' | grep -E "api-key|authorization|Bearer" |
awk '{print $0}' | tee -a /var/log/api_monitor.log
Set up alerting for abnormal API request volume
!/bin/bash
API_REQUESTS=$(grep -c "api.deepseek.com" /var/log/nginx/access.log)
if [ $API_REQUESTS -gt 1000 ]; then
echo "ALERT: Unusual DeepSeek API activity detected" | mail -s "AI API Alert" [email protected]
fi
3. The Manual vs. Autonomous Attack Hybrid Model
While autonomous AI attacks made headlines, the Unit 42 report reveals a more nuanced reality: the actor combined automated AI-driven enumeration with manual exploitation. DeepSeek autonomously scanned targets and launched attacks—but these attempts largely failed due to restrictive target configurations. However, working by hand, the actor successfully exfiltrated memory from three Citrix NetScaler servers (CVE-2026-3055), hunted for NSC_AAAC session cookies, and ran commands on eleven Marimo notebooks (CVE-2026-39987).
Step-by-Step Guide to Detecting Hybrid Attack Patterns:
- Correlate Automated Scanning with Manual Intrusion: Look for patterns where mass scanning (AI-driven) is followed by targeted, human-like exploitation attempts.
- Monitor for Unusual Session Cookies: Specifically watch for NSC_AAAC cookie harvesting on Citrix NetScaler deployments.
- Deploy Honeypot Systems: Use decoy servers that mimic vulnerable configurations to detect AI-driven reconnaissance.
- Analyze Attack Timing: AI agents operate 24/7 with consistent patterns; manual attacks show variable timing and more complex decision-making.
Linux Command to Detect Cookie Exfiltration:
Monitor for suspicious cookie-related traffic
sudo tcpdump -i any -A -s 0 'port 443' | grep -E "NSC_AAAC|session|cookie" |
awk '{print $0}' | tee -a /var/log/cookie_monitor.log
Check for unusual file reads that may indicate data exfiltration
sudo ausearch -f /etc/shadow -f /var/www -f /home --format text |
grep -E "cat|less|vim|nano|head|tail" | tail -20
4. The Critical DeepSeek Harness RCE Vulnerability (QVD-2026-57410)
On August 25, 2026, QiAnXin Threat Intelligence Center disclosed an unauthenticated remote-code-execution vulnerability in DeepSeek Harness (DSH), an open-source AI agent platform. Tracked as QVD-2026-57410 with a CVSS 3.0 score of 9.8, the flaw stems from improper validation of the HTTP Host request header. By forging the Host header, an attacker can bypass the `/api` trust fence, call restricted internal RPC methods, register a fake large-model provider, and drive the Agent tool to execute arbitrary system commands on the target.
Step-by-Step Guide to Mitigating DeepSeek Harness RCE:
- Isolate Management API: Restrict the management API port from public network exposure; allow only trusted internal IPs.
- Enforce Strict Host-Header Validation: Implement reverse-proxy layer validation to reject forged Host headers.
- Add Authentication: Implement authentication mechanisms at the `/api` trust fence independent of the Host header.
- Restrict SSRF Vectors: Limit the `llm.discoverModels` interface to curb potential server-side request forgery risk.
- Upgrade Immediately: Follow DeepSeek’s official security advisories to upgrade to a patched version.
Nginx Configuration to Validate Host Headers:
server {
listen 443 ssl;
server_name your-deepseek-harness-domain.com;
Strict Host header validation
if ($host !~ ^your-deepseek-harness-domain.com$) {
return 444;
}
Restrict access to management API
location /api/ {
allow 192.168.1.0/24;
allow 10.0.0.0/8;
deny all;
Additional authentication
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
}
Linux Firewall Rules to Protect DeepSeek Harness:
Block public access to DeepSeek Harness management port (default 8080) sudo iptables -A INPUT -p tcp --dport 8080 -s 0.0.0.0/0 -j DROP sudo iptables -A INPUT -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT Log all connection attempts to the management port sudo iptables -A INPUT -p tcp --dport 8080 -j LOG --log-prefix "DSH-ACCESS: "
5. Defensive Strategies Against AI-Augmented Threat Actors
The threat actor UAT-10147 demonstrates how AI is being integrated across the entire attack lifecycle—from reconnaissance to payload generation, validation, and persistence. This group uses AI tools like PentestGPT, DeepAudit, and Metasploit to automate intrusion operations at scale, targeting Windows and Linux web servers across education, media, technology, and gaming sectors.
Step-by-Step Guide to Building AI-Resilient Defenses:
- Assume AI-Driven Reconnaissance: Treat all internet-facing systems as if they will be automatically discovered and scanned. Implement aggressive rate-limiting and anomaly detection.
- Harden Default Configurations: AI agents often fail against targets with non-default configurations—enforce `auto_login` disabled, require authentication for all endpoints, and disable unnecessary services.
- Deploy EDR with Behavioral Analysis: Use endpoint detection and response tools that can identify AI-generated attack patterns, which often exhibit predictable, script-like behavior.
- Implement Zero-Trust Architecture: Assume breach and enforce least-privilege access across all systems.
- Monitor for AI Tool Signatures: Look for traffic patterns associated with FOFA, Hermes Agent, PentestGPT, and DeepAudit.
Windows Command to Detect AI Tool Artifacts:
Check for suspicious processes associated with known AI attack tools
Get-Process | Where-Object {$_.ProcessName -match "python|node|java|dotnet"} |
Select-Object ProcessName, CPU, WorkingSet, StartTime
Search for AI-generated exploit files
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object {$_.Name -match "exploit|payload|shell|reverse|backdoor"} |
Select-Object FullName, LastWriteTime, Length
Check Windows scheduled tasks for persistence mechanisms
Get-ScheduledTask | Where-Object {$_.TaskName -match "Google|Chrome|Update|Adobe"} |
Select-Object TaskName, State, Actions
6. The Accidental Exposure That Revealed Everything
The most fascinating aspect of this investigation is how researchers gained visibility: the autonomous agent inadvertently started a Python HTTP file server in its home directory instead of an isolated staging folder. This exposed API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work. This operational security failure highlights that even sophisticated threat actors make mistakes—and that AI agents, when misconfigured, can become liabilities.
Step-by-Step Guide to Preventing Accidental Exposure:
- Implement Strict File Server Policies: Never allow HTTP servers to run in home directories or non-staging paths.
- Use Isolated Environments: Always use containerized or sandboxed environments for testing and staging.
- Automated Configuration Audits: Regularly scan for exposed file servers, open directories, and misconfigured services.
- Log and Alert on Unauthorized Services: Monitor for unexpected HTTP/HTTPS services starting on non-standard ports.
Linux Command to Detect Unauthorized HTTP Servers:
Scan for unexpected HTTP services on your network
sudo nmap -sS -p 80,443,8000,8080,8443,9000 --open <YOUR_NETWORK_RANGE>
Check for Python HTTP servers running in unexpected locations
ps aux | grep -E "python.SimpleHTTPServer|python.http.server" |
grep -v grep | awk '{print $2, $11, $12, $13}'
Monitor for new file server processes
!/bin/bash
while true; do
NEW_SERVERS=$(ps aux | grep -E "SimpleHTTPServer|http.server" | grep -v grep | wc -l)
if [ $NEW_SERVERS -gt 0 ]; then
echo "ALERT: Unauthorized HTTP server detected at $(date)" |
mail -s "File Server Alert" [email protected]
fi
sleep 60
done
7. The Browser-1ative Ransomware Threat
Beyond autonomous attacks, DeepSeek has been used to generate novel malware—including browser-1ative ransomware that runs entirely inside the browser on Windows, Linux, macOS, and Android devices. Check Point Research unearthed a Python Flask application generated by DeepSeek that combined “unrealistic browser-malware concepts with a real browser capability” to create a working ransomware technique. The original incomplete DeepSeek sample could be transformed into a fully functional attack with minimal effort.
Step-by-Step Guide to Defending Against AI-Generated Malware:
- Deploy Browser Isolation: Use remote browser isolation to prevent malicious code from executing on endpoints.
- Implement Application Allowlisting: Restrict which applications can run on endpoints, blocking unauthorized Python, PowerShell, and script execution.
- Monitor for Unusual Browser Behavior: Look for browsers consuming excessive CPU/memory or making unusual network connections.
- Use AI-Powered Anti-Malware: Deploy security solutions that use machine learning to detect AI-generated malware patterns.
Windows PowerShell to Detect Browser-Based Malware:
Monitor browser processes for unusual behavior
Get-Process | Where-Object {$_.ProcessName -match "chrome|firefox|edge"} |
Select-Object ProcessName, CPU, WorkingSet, HandleCount
Check for suspicious browser extensions
Get-ChildItem -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions" |
Select-Object Name, LastWriteTime
Monitor for unauthorized Python scripts
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
Where-Object {$_.Message -match "ScriptBlock"} |
Select-Object TimeCreated, Message
What Undercode Say:
- Key Takeaway 1: Absence of Guardrails Is an Offensive Feature—Threat actors are not choosing AI models based solely on capability; they are actively selecting models with the fewest safety controls. DeepSeek became the primary attack engine not because it was the most powerful, but because Western provider-side safeguards on platforms like Claude and OpenAI effectively blocked offensive requests. This means that model safety posture has become an offensive capability selector—attackers are weaponizing the lack of safety as a feature.
-
Key Takeaway 2: AI-Driven Attacks Are Real but Imperfect—Despite alarming headlines, the most documented autonomous AI campaign did not successfully compromise any systems through autonomous means. The AI agent failed because targets required specific configurations (e.g., `auto_login` enabled or authenticated form endpoints). However, the actor’s manual efforts—using AI-generated intelligence to guide targeting—successfully compromised three Citrix NetScaler servers and eleven Marimo notebooks. The real threat is not fully autonomous AI hacking but AI-augmented human attackers who use AI to dramatically accelerate reconnaissance, exploit development, and decision-making.
-
Key Takeaway 3: Cost and Accessibility Are Driving Adoption—DeepSeek’s popularity among attackers stems from its combination of high performance, low operational costs, and minimal cybersecurity barriers. While other Chinese models like Kimi K3 are more powerful, their cost of operation is prohibitively expensive for attackers seeking to scale volume. This economic dynamic means that as more cheap, customizable AI models become available, the barrier to entry for sophisticated cyber operations will continue to fall—demanding a new paradigm in defensive cybersecurity that accounts for AI-augmented threat actors operating at machine speed.
Prediction:
-
+1 AI-Powered Defensive Countermeasures Will Accelerate—Just as attackers are using AI to automate offensive operations, defenders will increasingly deploy AI-driven security tools to detect and respond to AI-augmented attacks at machine speed. Organizations that invest in AI-powered SIEM, SOAR, and threat intelligence platforms will gain a significant advantage in identifying and mitigating autonomous attack patterns.
-
+1 Regulatory Frameworks for AI Safety Will Tighten—The documented weaponization of DeepSeek and other open-source AI models will accelerate regulatory efforts to mandate safety guardrails, content filtering, and usage monitoring for commercially available AI systems. Expect increased pressure on AI providers to implement provider-side safeguards that block malicious use cases.
-
-1 Proliferation of AI-Generated Malware—The demonstrated ability to generate functional malware—including browser-1ative ransomware—using DeepSeek with minimal effort signals a coming wave of AI-generated malicious code. This will overwhelm traditional signature-based detection and require a fundamental shift toward behavioral and AI-powered detection mechanisms.
-
-1 Geopolitical Escalation in AI Cyber Arms Race—The use of state-linked hacking groups deploying Chinese AI models against Taiwanese targets and global infrastructure represents a new front in cyber warfare. This will likely lead to increased tensions, retaliatory cyber operations, and the development of AI-specific offensive and defensive capabilities by nation-states worldwide.
-
+1 Increased Focus on AI Supply Chain Security—The DeepSeek Harness RCE vulnerability (QVD-2026-57410) and the proliferation of counterfeit DeepSeek domains highlight critical supply chain risks. Organizations will invest more in AI supply chain security, including rigorous vetting of AI models, API security, and continuous monitoring for vulnerabilities in AI infrastructure.
-
-1 Democratization of Sophisticated Cyberattacks—The low cost and accessibility of DeepSeek and similar AI models means that sophisticated cyberattack capabilities are no longer the exclusive domain of well-resourced nation-state actors. Smaller criminal groups, hacktivists, and even individual attackers can now leverage AI to conduct reconnaissance, generate exploits, and develop malware—dramatically expanding the threat landscape.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=87tVVB87we0
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/e6jR-KZi – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
