DeepSeek-Powered Hermes Agent Autonomous Cyberattacks Target Exposed Servers

Key Takeaways

• A Chinese-speaking threat actor utilized an AI-powered agent, Hermes, driven by the DeepSeek model, to autonomously identify and initiate attacks against internet-facing servers.
• The campaign targeted vulnerabilities in Langflow and n8n systems, demonstrating a move towards more automated reconnaissance and exploit execution.
• While the AI-led attacks did not achieve full compromise in their automated phase, the broader operation, which included traditional attack methods, resulted in confirmed data theft and command execution on targets like Citrix NetScaler and Marimo notebooks.
• Researchers gained unprecedented insight into the attacker’s methodology due to a misconfiguration that exposed the Hermes Agent’s operational environment.
• Organizations are urged to promptly patch vulnerable applications, enforce authentication on public-facing forms, and monitor for unusual network activity.

A sophisticated cyber campaign, spearheaded by a Chinese-speaking threat actor, has leveraged an artificial intelligence (AI) driven agent to conduct autonomous attacks against exposed servers. This operation marks a significant evolution in attack methodologies, showcasing how AI can streamline the entire attack chain from target identification to exploit deployment with minimal human intervention.

The campaign specifically focused on vulnerable Langflow and n8n systems, though the threat actor also employed conventional tools to target other critical infrastructure, including Citrix NetScaler devices, Marimo notebooks, Apache Tomcat servers, and VPN endpoints. While the AI-orchestrated attacks did not achieve complete system compromise, the broader, multi-pronged operation successfully led to data exfiltration and command execution on several targets.

Researchers at Unit42 discovered this campaign after the Hermes Agent inadvertently exposed its own operational environment through an internet-accessible file server. This critical error provided analysts with a trove of data, including attack scripts, target lists, API configurations, command histories, and detailed logs of autonomous sessions, offering a rare glimpse into a live AI-powered offensive operation.

As Palo Alto Networks said in a report, this incident is particularly noteworthy because it documents a functional offensive process rather than merely a theoretical risk. The AI component enabled the threat actor to rapidly analyze vulnerabilities, locate public proof-of-concept (PoC) code, filter extensive target pools, and execute exploit attempts at a speed unachievable through manual efforts alone.

DeepSeek-Powered Hermes Agent

The core of the autonomous attacks was the Hermes Agent, which functioned as the operational framework, with DeepSeek serving as its reasoning engine. Hermes provided essential capabilities such as terminal access, a system for managing attack “skills,” and command-and-control (C2) facilitated via Telegram. DeepSeek, on the other hand, was responsible for assessing potential targets, generating attack commands, identifying suitable exploit tools, and making strategic decisions about the next steps in the attack sequence.

The system was equipped with custom red-team skills designed to circumvent AI model limitations, exploit unauthenticated web services, and discover internet-facing assets. This sophisticated setup elevates the campaign beyond simple AI-assisted scripting, demonstrating a capability for a repeatable, automated cycle of reconnaissance, vulnerability research, and attack execution.

In one autonomous session, the agent investigated a Langflow vulnerability and scanned for vulnerable deployments. It identified one potentially susceptible system; however, the exploit required specific conditions that were not met. Consequently, the agent autonomously assessed Langflow as a low-value target family and shifted its focus.

The agent then evaluated deployment numbers and public exploit availability across ten different product families before selecting n8n as its next target. This decision-making process highlighted the agent’s ability to weigh factors such as vulnerability severity, potential reach, and exploit prerequisites – risks that have also been emphasized in reports concerning critical n8n server takeover flaws affecting exposed automation systems.

The agent proceeded to scan approximately 100 n8n addresses from a much larger dataset, analyzing roughly 40 distinct systems. It successfully identified three instances running vulnerable versions. While the subsequent exploitation attempts failed due to the requirement for authentication on the exposed form endpoints, the narrow margin of failure presents a significant concern for cybersecurity defenders, underscoring the operational viability of such autonomous systems.

Unit42 noted that the AI model independently pivoted its strategy after its initial attempt against Langflow failed, rather than waiting for human intervention to redirect its efforts. This demonstrates a level of autonomy that significantly reduces the operational overhead for threat actors.

Exposed Infrastructure Raises Risk

Beyond the autonomous AI operations, the same threat actor conducted separate manual campaigns with confirmed success. Unit42 verified the successful exploitation of three targets through a memory-read vulnerability in Citrix NetScaler. The stolen memory was subsequently analyzed for authentication cookie material, which could enable session hijacking.

This activity aligns with ongoing warnings regarding active exploitation of NetScaler vulnerabilities, urging organizations to prioritize patching. The threat actor also achieved command execution on Marimo notebook instances and attempted to establish reverse-shell access against Apache Tomcat and VPN targets.

Ironically, the AI campaign revealed a critical operational flaw on the attacker’s side. The Hermes Agent initiated a web file server from the operator’s home directory instead of an isolated staging environment. This misconfiguration inadvertently exposed sensitive data that would typically be erased post-attack, providing cybersecurity researchers with invaluable insights.

These findings confirm that autonomous AI attack cycles are indeed operationally viable, even if the automated attempts in this particular campaign did not result in full compromise. The incident reinforces growing concerns about the security risks posed by exposed AI agents that possess extensive access to systems and credentials.

What You Should Do

• Patch Immediately: Prioritize and apply security patches for all internet-facing applications, especially Langflow, n8n, Citrix NetScaler, Marimo notebooks, Apache Tomcat, and VPN endpoints.
• Enforce Strong Authentication: Ensure all public-facing workflow forms and management interfaces require robust authentication, preferably multi-factor authentication (MFA).
• Limit Exposure: Reduce the direct exposure of automation platforms and critical services to the public internet. Implement strict network segmentation and access controls.
• Monitor for Anomalies: Regularly review system logs for unusual scanning activities, unexpected workflow modifications, and outbound connections originating from systems that should not be initiating them.
• Conduct Asset Inventory: Perform a thorough audit of your asset inventory to identify all externally reachable Langflow, n8n, and NetScaler deployments.
• Review Automation Security: Leverage recent insights into workflow automation security gaps to re-evaluate and strengthen access controls, node permissions, and patch management practices for all automation platforms.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.