AI-Driven Autonomous Attacks: Detecting and Containing DeepSeek Exploitation via Hermes Agent

We have officially entered the era of autonomous AI-driven cyber operations. Palo Alto Networks' Unit 42 recently uncovered a campaign where a Chinese-speaking threat actor, tracked as knaithe (aka KnYuan), leveraged the DeepSeek AI model via the Hermes Agent framework to launch attacks without further human intervention.

The implications are severe. By integrating Large Language Models (LLMs) with open-source agent frameworks, adversaries can offload the tedious work of reconnaissance, target selection, and vulnerability scanning to an AI. The operator issues a single command via Telegram, and the agent autonomously identifies internet-facing systems and selects public security issues to exploit. This shift from "human-in-the-loop" to "human-on-the-loop" drastically increases the speed and scale at which adversaries can pivot from initial access to widespread compromise.

Technical Analysis

Attack Chain Breakdown

Command & Control (C2) Interface: The operator utilizes Telegram as the initial command channel. This provides anonymity and leverages a widely allowed communication protocol that is often difficult to block in enterprise environments without user impact.
Agent Framework: The attack utilizes the open-source Hermes Agent. This framework acts as the orchestrator, capable of interpreting high-level instructions and managing the execution of tasks.
AI Reasoning Engine: The agent interacts with DeepSeek to perform reasoning tasks. Instead of running static scripts, the agent queries the AI to decide what to do next. In the observed incident, DeepSeek autonomously identified internet-facing targets and selected specific public security issues to exploit.
Autonomous Execution: Unit 42 researchers observed that after the initial Telegram instruction, no further operator input was detected. The Hermes Agent, guided by DeepSeek, conducted the entire operation independently.

Exploitation Status

Confirmed Active Exploitation: Yes, observed by Unit 42 in the wild.
Vulnerabilities Targeted: The agent autonomously selects "public security issues." While no specific CVE was listed in the report, the behavior implies the automated exploitation of known, unpatched vulnerabilities exposed to the internet.

Detection & Response

Detecting these attacks requires identifying the components of the kill chain: the presence of the agent framework, the use of AI APIs, and the anomalous network traffic associated with autonomous scanning.

Sigma Rules

YAML

---
title: Potential Hermes Agent Python Execution
id: 88c4d2a1-9b3f-4c1d-8e5a-2f7b9c8d0e1f
status: experimental
description: Detects the execution of Python scripts often associated with the Hermes Agent framework or similar autonomous agents. Looks for common keywords in command line arguments.
references:
  - https://unit42.paloaltonetworks.com/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_python:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
  selection_keywords:
    CommandLine|contains:
      - 'hermes'
      - 'agent'
      - 'autonomous'
      - 'deepseek'
  condition: all of selection_*
falsepositives:
  - Legitimate developer usage of AI libraries or unrelated tools named 'agent'
level: high
---
title: Telegram API Usage from Server Infrastructure
id: 33f1b4e2-8a2c-4d9e-9b1c-5e6a7f8d9e0a
status: experimental
description: Detects processes connecting to Telegram API endpoints from backend server systems. While common on user endpoints, this is suspicious behavior for servers and may indicate C2 activity.
references:
  - https://unit42.paloaltonetworks.com/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.telegram.org'
      - 'web.telegram.org'
  filter_generic:
    Image|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
      - '\Windows\System32\'
  condition: selection and not filter_generic
falsepositives:
  - Administrators using Telegram for notifications on servers (rare)
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes connecting to Telegram infrastructure, focusing on non-standard applications like Python or scripting languages commonly used in agent frameworks.

KQL — Microsoft Sentinel / Defender

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("telegram.org", "api.telegram.org")
| join kind=inner DeviceProcessEvents on DeviceId, InitiatingProcessId
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "pwsh.exe", "powershell.exe", "bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemotePort
| order by Timestamp desc

Velociraptor VQL

Hunts for specific process artifacts associated with Python-based agents and checks for established network connections to Telegram.

VQL — Velociraptor

-- Hunt for Python processes connecting to Telegram endpoints
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'python'
   AND CommandLine =~ '(?i)(agent|hermes|deepseek)'

-- Cross-reference with network connections
SELECT Pid, RemoteAddress, RemotePort, State
FROM netstat()
WHERE RemoteAddress =~ '149.154.160.0/20' OR RemoteAddress =~ '91.108.4.0/22'

Remediation Script (Bash)

This script assists in blocking communication with known Telegram IP ranges at the firewall level to disrupt C2 channels. This is a containment measure for Linux-based servers.

Bash / Shell

#!/bin/bash

# Remediation: Block Telegram IP ranges to disrupt C2
# Usage: sudo ./block_telegram_c2.sh

echo "[+] Updating iptables to block Telegram C2 infrastructure..."

# Telegram IP ranges (Current as of 2026)
TG_RANGES=(
    "149.154.160.0/20"
    "91.108.4.0/22"
    "91.108.56.0/22"
    "91.108.8.0/22"
    "91.108.12.0/22"
    "149.154.164.0/22"
    "149.154.168.0/22"
    "149.154.172.0/22"
)

for range in "${TG_RANGES[@]}"; do
    # Check if rule exists to avoid duplicates
    if ! iptables -C OUTPUT -d $range -j DROP &> /dev/null; then
        iptables -A OUTPUT -d $range -j DROP
        echo "[+] Blocked range: $range"
    else
        echo "[-] Rule already exists for: $range"
    fi
done

echo "[+] Verification:"
iptables -L OUTPUT -n -v | grep -E '149.154|91.108'

Remediation

Strict Egress Filtering: Implement firewall rules to block unauthorized access to Telegram API endpoints (api.telegram.org) and public Generative AI API endpoints (e.g., DeepSeek, OpenAI) from critical server segments. Servers should generally not require access to social platforms or consumer AI tools.
Vulnerability Management: Since the agent autonomously selects "public security issues," the primary defense is eliminating the surface area. Ensure all internet-facing systems are patched against known CVEs (2025-2026) immediately.
Agent and Script Monitoring: Monitor for the deployment of unauthorized agent frameworks. Restrict the execution of Python scripts and agents to signed or whitelisted directories.
Network Segmentation: Isolate systems performing high-risk tasks or exposed to the internet. Limit their ability to initiate outbound connections to non-essential IPs.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub