AIサイバー攻撃をDeepSeekが自律実行、侵害を確認したのは手動操作

The actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator. ／ Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making. ／ Claude Code: The actor only used this for connectivity testing and proxy validation. Session history (10 entries across three sessions) contained only /model checks, connectivity tests and one npm install request. ／ Hermes Agent, responding to a Telegram command, started an HTTP file server (python3 -m http.server 8888) from the actor's home directory (/home/worker) rather than an isolated staging directory. ／ The exposure was unintentional. The actor demonstrated operational security awareness elsewhere, having emptied exploit directories after use and disabled Codex conversation logging. ／ The same autonomous capability the actor developed for offensive use directly caused the exposure of the operation, producing forensic artifacts that would not have existed under manual execution. — ハッカー集団の別名、Hermes AgentとDeepSeekの役割分担、Claude Codeの利用範囲、ファイルサーバー起動による露出、ハッカー集団の運用上の注意、および自律実行が証拠を生んだという評価に関する記述より

We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026). We were unable to recover additional operator input beyond the initial task. ／ The exploitation attempts failed because the vulnerability requires either auto_login enabled or a public flow ID and the target had neither. ／ DeepSeek evaluated each candidate by severity, deployment footprint and exploitability before selecting n8n ／ FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China. ／ DeepSeek launched parallel scanning across 50-plus remaining Chinese targets. None had publicly accessible forms. The actor did not achieve exploitation. The recovered session data ends at this point. ／ This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources. — セッションの復元範囲、Langflowでの失敗の理由、標的の選び直しの評価軸、n8nの設置台数、並行走査で終わった経緯、および絞り込みの意味づけに関する記述より

we identified that this actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques. ／ Separate from the autonomous AI campaigns, the actor conducted manual operations using conventional workflows (FOFA enumeration, custom Python scanners and direct exploitation) with confirmed impact. ／ Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). However, we reviewed evidence of batch exploitation against an unknown number of hosts that were listed in a file deleted by the actor prior to our analysis. ／ The actor searched the exfiltrated data for NetScaler authentication cookies (NSC_AAAC=), indicating session hijacking intent. ／ Java deserialization reverse shell attempts against nine Apache Tomcat servers (CVE-2026-34486) ／ Reverse shell callbacks targeting three IKE VPN endpoints (CVE-2026-33824). ／ The cloned code is non-functional with placeholder values that cannot achieve code execution. No evidence of modification or execution was found. — 狙われた標的数、手動の攻撃の性格、確認された実害の2件と確認の限界、認証クッキーの検索、Tomcat・IKE VPNへの試み、およびPAN-OSの実証コードが未実行であった旨の記述より

Exploitation was prevented by target-side configuration requirements — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n). Targets with weaker default configurations would have been susceptible. ／ For their autonomous attack engine, the actor selected a model with minimal safety controls (DeepSeek) accessed through an open-source framework with no client-side restrictions. The actor attempted to use Western models, but their provider-side controls likely limited their effectiveness for autonomous attacks. ／ Note: Our colleagues at OpenAI were able to confirm that their provider-side safeguards refused requests that violated their policies. They also confirmed that continued attempts led their safety systems to flag and disable an account they believe is linked to this campaign prior to our intelligence sharing with their team. ／ The significance of these findings lies in the trajectory rather than the outcome of any individual campaign. ／ The technical barrier to AI-augmented offensive operations is low and continues to decrease. — 攻撃が防がれた理由、モデル選択に関する評価、OpenAI側の対応、および結論の軌道に関する記述より