INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

AI-Driven Hackers Automate Cyberattacks Using DeepSeek Models

| 2026-08-03 15:52 CRITICAL HIGH
JSON
Executive Summary AI-generated
The Chinese actor behind the recent cyberattacks using AI-driven tools, DeepSeek, has been identified as Unit 42. This autonomous scanning and exploitation campaign targeted Citrix NetScaler vulnerabilities across multiple organizations worldwide, including Malaysia, China, and others. The attacks leveraged a customized Hermes Agent with advanced red-teaming skills to identify and exploit weaknesses in various software systems. A Langflow vulnerability was also exploited, leading to the discovery of 84 live instances that were vulnerable to exploitation. This campaign highlights the sophistication and adaptability of modern cyber threats, as well as the importance of robust security measures to detect and respond to such attacks.
Technical Mitigations AI-generated
* Implement a secure file system and configure it to use isolated staging folders for sensitive data, such as API keys and exploit scripts. * Regularly update and patch large language models (LLMs) like Qwen, GLM, Kimi, MiniMax, and Codex to prevent exploitation of known vulnerabilities. * Use proxy servers or VPNs to route traffic through a third-party proxy when using Western tools like Claude Code and Codex, which may be vulnerable to attack. * Configure Hermes Agent with custom red-teaming skills that prioritize trusted tools over unknown ones, such as fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration.
Technical Observables
AI Podcast (EN) detail_available
detail_listen_ai (EN)
Intelligence distributed on:
Incident Link
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation Hermes AgentOperation Hermes Agent CVE-2026-33017CVE-2026-33017 CVE-2026-33824CVE-2026-33824 CVE-2026-34486CVE-2026-34486 CVE-2026-21858CVE-2026-21858 CVE-2026-39987CVE-2026-39987 CVE-2026-0300CVE-2026-0300 CVE-2026-3055CVE-2026-3055 CVE-2025-68613CVE-2025-68613
Target & Sectors
NORTH_AMERICA NORTH_AMERICA APAC APAC MIDDLE_EAST MIDDLE_EAST EUROPE EUROPE governmentgovernment defensedefense
Incident Timeline
‎May 5, 2026
Threat actors used AI to automate cyberattacks using DeepSeek.
‎May 7, 2026
Chinese actor DeepSeek customized Hermes Agent with a red-teaming framework, integrating it to automate cyberattacks through Hermes Agent's LLM jailbreaking and fofoapi.py script-based web-terminal exploitation.
observable fofoapi.py
The actor had customized Hermes Agent with three red-teaming skills: godmode : LLM jailbreaking, framework-bundled web-terminal-exploitation : unauthenticated WebSocket exploitation, custom-created fofa-cyberspace-search : a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration The actor also integrated the open-source FofaMap-Platinum-Full-Expert Model Context Protocol (MCP) server, which exposes: FOFA asset search Nuclei scan generation A DeepSeek-powered natural-language-to-FOFA query translator directly within the agent We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026).
organisation WebSocket
The actor had customized Hermes Agent with three red-teaming skills: godmode : LLM jailbreaking, framework-bundled web-terminal-exploitation : unauthenticated WebSocket exploitation, custom-created fofa-cyberspace-search : a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration The actor also integrated the open-source FofaMap-Platinum-Full-Expert Model Context Protocol (MCP) server, which exposes: FOFA asset search Nuclei scan generation A DeepSeek-powered natural-language-to-FOFA query translator directly within the agent We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026).
organisation MCP
The actor had customized Hermes Agent with three red-teaming skills: godmode : LLM jailbreaking, framework-bundled web-terminal-exploitation : unauthenticated WebSocket exploitation, custom-created fofa-cyberspace-search : a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration The actor also integrated the open-source FofaMap-Platinum-Full-Expert Model Context Protocol (MCP) server, which exposes: FOFA asset search Nuclei scan generation A DeepSeek-powered natural-language-to-FOFA query translator directly within the agent We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026).
organisation Nuclei
The actor had customized Hermes Agent with three red-teaming skills: godmode : LLM jailbreaking, framework-bundled web-terminal-exploitation : unauthenticated WebSocket exploitation, custom-created fofa-cyberspace-search : a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration The actor also integrated the open-source FofaMap-Platinum-Full-Expert Model Context Protocol (MCP) server, which exposes: FOFA asset search Nuclei scan generation A DeepSeek-powered natural-language-to-FOFA query translator directly within the agent We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026).
‎2026/08/03
The Chinese actor used AI to automate cyberattacks on 100 systems, targeting a Malaysian government entity.
infrastructure N8N
FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China.
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
Phase 4: n8n Target Enumeration and Exploitation Attempts DeepSeek ran FOFA queries targeting Chinese n8n instances and probed targets for version and form endpoints.
That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had.
But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes.
DeepSeek evaluated each candidate by severity, deployment footprint and exploitability before selecting n8n : The n8n one with 258 stars and CVSS 10.0 looks extremely promising !
n8n is a very popular workflow automation tool similar to Langflow , and it has way more stars on the PoC which suggests it ' s widely exploited .
Phase 3: n8n Vulnerability Assessment and Exploit Acquisition DeepSeek obtained the public n8n exploit PoC from the Chocapikk repository.
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances.
Autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow: Exploitation was prevented by target-side configuration requirements — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n).
Cortex Xpanse Cortex Xpanse has the ability to identify exposed Langlow, n8n and Citrix ADC/Netscaler devices on the public internet and escalate these findings to defenders.
organisation FOFA
FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China.
They orchestrated this operator via Telegram for the following activities: Independently enumerating targets and their vulnerabilities using FOFA Sourcing exploit tools Initiating attacks without human intervention In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) ( Qwen , GLM, Kimi, MiniMax).
victims 647,017 target
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
victims 25,209 target
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
organisation Target Enumeration and Exploitation Attempts
Phase 4: n8n Target Enumeration and Exploitation Attempts DeepSeek ran FOFA queries targeting Chinese n8n instances and probed targets for version and form endpoints.
victims 50 remaining Chinese targets
DeepSeek launched parallel scanning across 50-plus remaining Chinese targets.
organisation GitHub
That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had.
Phase 1: Langflow Exploitation (CVE-2026-33017) DeepSeek identified a Langflow vulnerability ( CVE-2026-33017 , CVSS 9.8) and autonomously attempted exploitation through the following steps: Downloading the public PoC exploit from GitHub Enumerating 84 Langflow instances via FOFA ( title="Langflow" ) Running the PoC scanner ( langflow_poc.py --scan-file langflow_targets.txt --threads 10 ) Identifying one vulnerable target (Langflow 1.3.4) The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither.
organisation IP
But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes.
For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances.
infrastructure 100 IP addresses
But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes.
For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances.
organisation Vulnerability Assessment
Phase 3: n8n Vulnerability Assessment and Exploit Acquisition DeepSeek obtained the public n8n exploit PoC from the Chocapikk repository.
infrastructure 1.121.0
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
infrastructure 1.120.4
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
organisation Citrix NetScaler ADC & Gateway
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
organisation Manual Active
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
organisation Apache Tomcat
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
organisation PAN
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
organisation User-ID Authentication Portal
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
financial 9.9 Automation Exploitation attempt
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
organisation Cortex Xpanse
Cortex Xpanse Cortex Xpanse has the ability to identify exposed Langlow, n8n and Citrix ADC/Netscaler devices on the public internet and escalate these findings to defenders.
organisation Langlow
Cortex Xpanse Cortex Xpanse has the ability to identify exposed Langlow, n8n and Citrix ADC/Netscaler devices on the public internet and escalate these findings to defenders.
organisation Citrix ADC/Netscaler
Cortex Xpanse Cortex Xpanse has the ability to identify exposed Langlow, n8n and Citrix ADC/Netscaler devices on the public internet and escalate these findings to defenders.
organisation GLM
They orchestrated this operator via Telegram for the following activities: Independently enumerating targets and their vulnerabilities using FOFA Sourcing exploit tools Initiating attacks without human intervention In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) ( Qwen , GLM, Kimi, MiniMax).
The actor also tested Qwen, GLM, Kimi, and MiniMax, and even poked at two Western tools, Claude Code and Codex, though only in a limited, exploratory way.
organisation Telegram
They orchestrated this operator via Telegram for the following activities: Independently enumerating targets and their vulnerabilities using FOFA Sourcing exploit tools Initiating attacks without human intervention In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) ( Qwen , GLM, Kimi, MiniMax).
Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.” continues the report.
organisation Citrix NetScaler
“Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets ( CVE-2026-3055 ) and command execution on 11 Marimo notebook endpoints ( CVE-2026-39987 ).
These included: Data exfiltration from three organizations via a Citrix NetScaler vulnerability ( CVE-2026-3055 )
infrastructure 11 Marimo notebook endpoints
“Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets ( CVE-2026-3055 ) and command execution on 11 Marimo notebook endpoints ( CVE-2026-39987 ).
organisation Frontier AI Defense
Palo Alto Networks customers are better protected from the threats described here through the following products and services: The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.
organisation the Citrix NetScaler
The three successful exploitations had memory data exfiltrated through the Citrix NetScaler out-of-bounds memory read vulnerability (CVE-2026-3055).
organisation Command
Command execution on 11 Marimo notebook instances ( CVE-2026-39987 )
organisation WebSocket
“The actor had customized Hermes Agent with three red-teaming skills: fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration” godmode: LLM jailbreaking, framework-bundled web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created” Watching DeepSeek work through an actual attack chain is the most striking part of the report.
organisation PoC
Phase 1: Langflow Exploitation (CVE-2026-33017) DeepSeek identified a Langflow vulnerability ( CVE-2026-33017 , CVSS 9.8) and autonomously attempted exploitation through the following steps: Downloading the public PoC exploit from GitHub Enumerating 84 Langflow instances via FOFA ( title="Langflow" ) Running the PoC scanner ( langflow_poc.py --scan-file langflow_targets.txt --threads 10 ) Identifying one vulnerable target (Langflow 1.3.4) The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither.
data_breach 10 file langflow_targets.txt
Phase 1: Langflow Exploitation (CVE-2026-33017) DeepSeek identified a Langflow vulnerability ( CVE-2026-33017 , CVSS 9.8) and autonomously attempted exploitation through the following steps: Downloading the public PoC exploit from GitHub Enumerating 84 Langflow instances via FOFA ( title="Langflow" ) Running the PoC scanner ( langflow_poc.py --scan-file langflow_targets.txt --threads 10 ) Identifying one vulnerable target (Langflow 1.3.4) The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither.
infrastructure Windows
They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints.
not executed CVE-2026-33824 Windows IKE Extensions (IKE VPN) 9.8 Manual Active exploitation, reverse shell attempts Table 2. CVEs exploited or staged by the threat actor.
organisation NetScaler
They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints.
The actor searched the exfiltrated data for NetScaler authentication cookies ( NSC_AAAC= ), indicating session hijacking intent.
organisation Windows IKE
They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints.
organisation Windows IKE Extensions
not executed CVE-2026-33824 Windows IKE Extensions (IKE VPN) 9.8 Manual Active exploitation, reverse shell attempts Table 2. CVEs exploited or staged by the threat actor.
organisation API
It exposed everything: API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work.
The actor accessed DeepSeek and Qwen directly through their native API endpoints.
organisation SecurityAffairs
“This research validates an emerging threat posed by AI-enabled attackers as they hone their autonomous attack processes to discover, assess, pivot and retarget without human intervention.” Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, AI)
infrastructure 18.0
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
infrastructure 117.3
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
infrastructure 108.2
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
organisation IKE
Reverse shell callbacks targeting three IKE VPN endpoints ( CVE-2026-33824 ).
organisation the Operation Hermes
How the AI Exposed the Operation Hermes Agent, responding to a Telegram command, started an HTTP file server ( python3 -m http.server 8888 ) from the actor's home directory ( /home/worker ) rather than an isolated staging directory.
infrastructure 8888 http.server
How the AI Exposed the Operation Hermes Agent, responding to a Telegram command, started an HTTP file server ( python3 -m http.server 8888 ) from the actor's home directory ( /home/worker ) rather than an isolated staging directory.
organisation PAN-OS CVE-2026-0300
PAN-OS CVE-2026-0300 The actor cloned a public repository ( qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC ) for CVE-2026-0300 , a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal (Captive Portal).
organisation User-ID Authentication Portal (Captive Portal
PAN-OS CVE-2026-0300 The actor cloned a public repository ( qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC ) for CVE-2026-0300 , a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal (Captive Portal).
organisation Chinese-Speaking Threat Actor Harnesses AI Models
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks.
organisation Technical Analysis
Technical Analysis We gained unique insights into this autonomous attack capability when the autonomous agent inadvertently exposed its infrastructure by starting a file server in its home directory.
organisation DeepSeek/Hermes
DeepSeek/Hermes Agent — Autonomous Attack Cycle DeepSeek, operating through the Hermes Agent framework, served as the actor's primary offensive AI tool.
organisation Target Selection After
Phase 2: Autonomous CVE Research and Target Selection After abandoning Langflow, DeepSeek conducted autonomous research to identify a higher-value vulnerability.
organisation Target
This exposed the actor's entire workspace: AI tool configurations API keys Exploit scripts Target lists Bash history Hermes autonomous exploitation session logs The exposure was unintentional.
organisation Targeting Analysis and Limited Success
Targeting Analysis and Limited Success From our analysis and visibility, we identified that this actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques.
victims 460 targets
Targeting Analysis and Limited Success From our analysis and visibility, we identified that this actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques.
organisation Autonomous AI
Autonomous AI execution introduces novel operational security risks for threat actors: The same autonomous capability the actor developed for offensive use directly caused the exposure of the operation, producing forensic artifacts that would not have existed under manual execution.
organisation Palo Alto Networks Protection and Mitigation
Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex XDR and XSIAM To combat an attack in which an attacker takes advantage of software exploits or vulnerabilities, Cortex XDR employs Endpoint Protection Modules (EPM).
organisation Cortex XDR
Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex XDR and XSIAM To combat an attack in which an attacker takes advantage of software exploits or vulnerabilities, Cortex XDR employs Endpoint Protection Modules (EPM).
organisation XSIAM
Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex XDR and XSIAM To combat an attack in which an attacker takes advantage of software exploits or vulnerabilities, Cortex XDR employs Endpoint Protection Modules (EPM).
organisation EPM
Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex XDR and XSIAM To combat an attack in which an attacker takes advantage of software exploits or vulnerabilities, Cortex XDR employs Endpoint Protection Modules (EPM).
organisation Behavioral Threat Protection
This approach combines several layers of protection, including Advanced WildFire , Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.
organisation the Local Analysis
This approach combines several layers of protection, including Advanced WildFire , Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.
organisation Expander
Identified findings can be viewed in the incident view of Expander.
organisation Cortex XSIAM/XDR/Cloud
These findings are also available for Cortex XSIAM/XDR/Cloud customers with the ASM license.
organisation ASM
These findings are also available for Cortex XSIAM/XDR/Cloud customers with the ASM license.
organisation Next-Generation Firewall
Next-Generation Firewall with Advanced Threat Prevention Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signatures 97030 , 96882 , 96855 , 97044 , 97046 , 97251 , 97177 , and 510019 .
organisation Threat Prevention
Next-Generation Firewall with Advanced Threat Prevention Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signatures 97030 , 96882 , 96855 , 97044 , 97046 , 97251 , 97177 , and 510019 .
organisation Palo Alto Networks
+82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members.
organisation Cyber Threat Alliance
+82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members.
organisation CTA
+82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members.
organisation Additional Resources
Additional Resources
infrastructure 40 unique IP addresses
Of those 100 systems, it probed roughly 40 unique IP addresses, checking their version via curl commands.
Tactical Metrics
Metrics
infrastructure
‎N8N
Affected Product
FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China.
That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had.
But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes.
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
DeepSeek evaluated each candidate by severity, deployment footprint and exploitability before selecting n8n : The n8n one with 258 stars and CVSS 10.0 looks extremely promising !
n8n is a very popular workflow automation tool similar to Langflow , and it has way more stars on the PoC which suggests it ' s widely exploited .
Phase 3: n8n Vulnerability Assessment and Exploit Acquisition DeepSeek obtained the public n8n exploit PoC from the Chocapikk repository.
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
Phase 4: n8n Target Enumeration and Exploitation Attempts DeepSeek ran FOFA queries targeting Chinese n8n instances and probed targets for version and form endpoints.
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances.
Autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow: Exploitation was prevented by target-side configuration requirements — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n).
Cortex Xpanse Cortex Xpanse has the ability to identify exposed Langlow, n8n and Citrix ADC/Netscaler devices on the public internet and escalate these findings to defenders.
Metrics
infrastructure
11
Marimo Notebook Endpoints
“Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets ( CVE-2026-3055 ) and command execution on 11 Marimo notebook endpoints ( CVE-2026-39987 ).
Metrics
infrastructure
100
Ip Addresses
But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes.
For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances.
Metrics
infrastructure
‎Windows
Affected Product
They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints.
not executed CVE-2026-33824 Windows IKE Extensions (IKE VPN) 9.8 Manual Active exploitation, reverse shell attempts Table 2. CVEs exploited or staged by the threat actor.
Metrics
victims
647,017
Target
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
Metrics
victims
25,209
Target
FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China.
Metrics
data_breach
10
File Langflow_Targets.Txt
Phase 1: Langflow Exploitation (CVE-2026-33017) DeepSeek identified a Langflow vulnerability ( CVE-2026-33017 , CVSS 9.8) and autonomously attempted exploitation through the following steps: Downloading the public PoC exploit from GitHub Enumerating 84 Langflow instances via FOFA ( title="Langflow" ) Running the PoC scanner ( langflow_poc.py --scan-file langflow_targets.txt --threads 10 ) Identifying one vulnerable target (Langflow 1.3.4) The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither.
Metrics
infrastructure
‎1.121.0
Software Version
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
Metrics
infrastructure
‎1.120.4
Software Version
The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: The following are advisories from n8n: DeepSeek analyzed affected version ranges to identify exploitable targets: CVE says fixed in 1.121.0 for AFR and 1.120.4 + for RCE .
Metrics
infrastructure
‎18.0
Software Version
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
Metrics
infrastructure
‎117.3
Software Version
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
Metrics
infrastructure
‎108.2
Software Version
Three instances were confirmed to be running vulnerable versions (v1.18.0, v1.117.3, v1.108.2).
Metrics
infrastructure
8,888
Http.Server
How the AI Exposed the Operation Hermes Agent, responding to a Telegram command, started an HTTP file server ( python3 -m http.server 8888 ) from the actor's home directory ( /home/worker ) rather than an isolated staging directory.
Metrics
financial
10
Automation Exploitation Attempt
CVE Product CVSS Method Actor Activity CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned,
Metrics
victims
50
Remaining Chinese Targets
DeepSeek launched parallel scanning across 50-plus remaining Chinese targets.
Metrics
victims
460
Targets
Targeting Analysis and Limited Success From our analysis and visibility, we identified that this actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques.
Metrics
infrastructure
40
Unique Ip Addresses
Of those 100 systems, it probed roughly 40 unique IP addresses, checking their version via curl commands.
Intelligence Sources
Palo Alto 2026-07-30
Security Affairs 2026-08-03