Chinese Hacker Uses DeepSeek via Telegram for Autonomous Attacks

Unit 42 found a Chinese-speaking threat actor using DeepSeek through the Hermes Agent framework to launch autonomous attacks. After a single Telegram instruction, the agent identified internet-facing systems and selected public exploits without further operator input. The operator, tracked as knaithe and KnYuan, remained silent during the session.