The First Documented AI-Run Hacking Campaign Weaponized DeepSeek Against Tomcat Servers

An AI Did the Reconnaissance, the Research, and the Exploitation

Security researchers have warned for years that AI would eventually run offensive operations end to end. In August 2026, Palo Alto Networks’ Unit 42 documented a campaign that shows it happening. A Chinese-speaking threat actor operating under the aliases “knaithe” and “KnYuan,” based in Zhuhai, China, wired the DeepSeek model into a custom framework called Hermes Agent and used it as the reasoning brain of an autonomous attack pipeline.

The architecture is the story. According to Unit 42, the operator orchestrated the agent through a Telegram channel, integrated it with the FOFA internet-asset search engine for target discovery, and equipped it with custom offensive-security skills. In one recovered session dated May 7, 2026, the operator appears to have provided only an initial task — after which the agent independently enumerated targets and their vulnerabilities, sourced exploit code, selected which targets were worth attacking, and attempted exploitation, compressing into minutes work that would normally take a human many hours.

This is the qualitative shift. Previous “AI in cyberattacks” reporting mostly described AI helping write phishing lures or malware snippets. Here the AI is the operator, running the kill chain with minimal human feedback.

The Tomcat Flaw at the Center

The campaign’s most consequential target was a specific, patchable vulnerability. Unit 42 records reverse-shell attempts against Apache Tomcat via CVE-2026-34486, a flaw rated CVSS 7.5. As The Hacker News detailed in its CISA coverage, the vulnerability is a “missing encryption of sensitive data” issue that “allows a bypass of EncryptInterceptor, a cluster component that adds pre-shared key encryption to messages sent between cluster nodes.” In effect, a component meant to protect Tomcat cluster traffic could be bypassed, exposing data that administrators assumed was encrypted.

The fix already exists. The Hacker News notes the flaw was addressed in April 2026 in Tomcat versions 11.0.21, 10.1.54 and 9.0.117 — meaning every server the agent successfully reached was running software that had had a patch available for months. The vulnerability being exploitable is an operational failure to patch, not a zero-day surprise.

The campaign did not stop at Tomcat. Unit 42 reports the agent also targeted CVE-2026-33824, a Windows IKE Extensions VPN flaw rated CVSS 9.8 — a broader toolkit aimed at whatever exposed, exploitable systems FOFA surfaced.

The Regulator’s Response

The exploitation was serious enough to trigger a federal patching mandate. Per The Hacker News, CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog in early August 2026 with an August 7, 2026 remediation deadline for federal agencies, alongside two other actively exploited flaws: CVE-2026-9198, a Langflow remote-code-execution bug rated CVSS 9.8, and CVE-2026-18556, an N-able N-central authentication bypass rated CVSS 8.2.

The KEV listing matters beyond U.S. government networks. It is the clearest possible signal to every organization running Tomcat that this is not a theoretical risk — it is being actively exploited in the wild, by an automated system that does not need a human to notice your server exists.

The Hit Rate Is Not the Point

It would be easy to dismiss the campaign as a failure. As BleepingComputer reported, the actor deployed DeepSeek as “the reasoning engine behind Hermes Agent” and targeted “more than 460 systems,” yet Unit 42 confirmed only three successful compromises — a success rate under 1%. But reading that as reassurance misunderstands what changed.

The three compromises Unit 42 confirmed involved real damage, including memory-based data exfiltration from Citrix NetScaler instances tied to a Malaysian government entity. More importantly, the low hit rate reflects the current maturity of the tooling, not a ceiling. An autonomous agent that can attempt 460 targets from a single initial instruction has effectively zero marginal cost per additional target. When the economics of attacking collapse to near-zero, the calculus for defenders inverts: it no longer matters whether you are a valuable target, only whether you are an exploitable one. A 1% hit rate applied to millions of exposed servers is still a large number of victims — and the percentage only rises as the agents improve.

What This Means for Algerian SMBs

Autonomous, AI-scaled scanning erases the “too small to target” assumption. For Algerian small and medium businesses running exposed Java web servers, the defensive priorities are concrete.

1. Patch internet-facing Tomcat and VPN gateways on a KEV-driven schedule

CVE-2026-34486 had a fix available months before it was exploited. Treat CISA’s Known Exploited Vulnerabilities catalog as a prioritized to-do list: any flaw on it that touches your stack — Tomcat, Langflow, N-central, VPN gateways — gets patched first and fast. The agent found victims among the unpatched, not the unlucky.

2. Shrink your internet-facing attack surface

The agent’s power came from FOFA-driven discovery of exposed assets. Anything that does not need to face the public internet should not — put admin interfaces, clustering ports and management consoles behind a VPN or access controls. You cannot be auto-exploited on a service that an internet-wide scanner cannot see.

3. Assume you are in scope and monitor accordingly

An autonomous agent attacking 460 targets from one instruction does not skip Algeria because a business is small or local. Deploy basic detection on internet-facing servers — log and alert on anomalous inbound exploitation attempts and unexpected outbound reverse-shell connections — so that an automated probe is caught early rather than discovered after exfiltration.

The Structural Shift

The knaithe/KnYuan campaign is a proof of concept, and its low success rate should not obscure what it proves: the labor cost of running an offensive operation is being automated away. For decades, the practical protection for small and obscure organizations was that a human attacker had to choose to spend time on them, and usually would not. An autonomous agent removes the choice by removing the cost. It scans everything, researches every finding, and attacks everything exploitable, because doing so is nearly free.

That is why the takeaway is not “DeepSeek was used to hack” but “the barrier that kept most organizations safe by obscurity is disappearing.” The defensive response is unglamorous and entirely within reach: patch what is on the KEV list, hide what does not need to be exposed, and monitor what remains. Those are the same fundamentals security teams have preached for years — but in a world of autonomous attackers, they are no longer optional hygiene. They are the difference between being one of the 460 the agent missed and one of the three it did not.

Frequently Asked Questions

Sources & Further Reading

• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks — Unit 42, Palo Alto Networks
• CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited — The Hacker News
• Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers — BleepingComputer