Chinese-speaking hacker used DeepSeek to hunt for vulnerable servers

A Chinese-speaking hacker has used the Chinese AI model DeepSeek to find targets and attack servers. That is according to BleepingComputer and Cybersecurity Dive, citing a report from the security company Palo Alto Networks' Unit 42.

The researchers discovered the campaign by chance. The hacker had accidentally left a web server exposed, and it contained access keys, attack scripts, target lists and logs of the attacks, among other things. That allowed Unit 42 to reconstruct a session from May 2026.

How it worked

The hacker uses the aliases "knaithe" and "KnYuan" and calls himself a "binary security researcher." According to Cybersecurity Dive, the researchers believe he was independent and not state-backed.

DeepSeek was the primary AI engine. It was run through Hermes Agent, an open source tool that can carry out tasks on its own, and controlled via Telegram. The tool searched GitHub for recently published proof-of-concept code for exploiting vulnerabilities. DeepSeek also searched for valuable targets on its own and found a chained vulnerability in the workflow platform n8n.

Unit 42 stresses that in a matter of minutes, the system performed target analysis that would otherwise take hundreds of hours to do manually.

Limited results

Initially, 84 exposed Langflow servers were identified, along with more than 647,000 exposed n8n instances. More than 460 systems were attacked across multiple products.

The outcome was modest, however. Only three compromises are confirmed in one of the write-ups, all via a vulnerability in Citrix NetScaler. The other also mentions a successful exploit of Marimo notebooks. The attacks on the primary targets failed, partly because they required a login. According to Cybersecurity Dive, the successful intrusions were carried out manually, not by AI alone.

How many organizations were hit or targeted is not clear. Andy Piazza, senior director at Unit 42, says: "We don't know whether the selection of targets was intentional or whether it was simply a random list."

The attacker only tested Western AI tools such as Claude Code and Codex to a limited extent.

More groups are using AI

The Taiwanese security company TeamT5 says separately that state-affiliated Chinese hacker groups have more than doubled their attack frequency since they started using AI tools. According to TeamT5, a startup with about 10 employees sold custom tools to at least four hacker groups for $44,500-$74,000. The group Grimfengxi used DeepSeek to write code for exploiting vulnerabilities.

TeamT5 chief analyst Charles Li says DeepSeek is the hackers' preferred AI because it is relatively powerful and has very weak safeguards.

The information about the attacker and the course of events comes from Unit 42, and TeamT5's figures are the company's own.