Hermes Agent AI-Enabled Autonomous Attack Campaign

Unit 42 has identified a functional, end-to-end autonomous offensive campaign conducted by a Chinese-speaking threat actor known as knaithe (or KnYuan). The actor leveraged the Hermes Agent framework, primarily using the DeepSeek LLM as a reasoning engine to independently identify targets via FOFA, source exploit PoCs from GitHub, and initiate attack cycles without human intervention. While the autonomous portion of the campaign saw limited success due to target-side configurations, it demonstrates a viable shift toward high-speed, AI-driven targeting and exploitation cycles.

In addition to AI-driven activities, the actor conducted manual campaigns with confirmed impact, including data exfiltration and reverse shell attempts targeting Citrix NetScaler, Apache Tomcat, and IKE VPN endpoints. The operation was inadvertently exposed when the Hermes Agent started an unauthenticated HTTP file server in the actor's home directory, revealing API keys, exploit scripts, and session logs. This campaign highlights the emerging risk of AI-augmented tradecraft that reduces the time required for vulnerability-to-exploitation pivots from days to minutes.