Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks

A Chinese-speaking threat actor utilized DeepSeek, a tool deployed through the Hermes Agent framework, to carry out autonomous attacks. The actor initially provided instructions via Telegram, after which the agent independently identified internet-facing systems and chose public exploits to use. No additional input from the operator was found during the session. The threat actor is tracked by the aliases knaithe and KnYuan, according to researchers at Palo Alto Networks' Unit 42.