Weaponized AI: Detecting DeepSeek Agent Proxyjacking Campaigns

Introduction

We have officially entered the era of AI-augmented cyber warfare. Recent intelligence from Security Arsenal researchers confirms that a Chinese-aligned threat actor has weaponized a DeepSeek AI agent to automate the compromise of over 1,200 hosts. The objective of this campaign is "proxyjacking"—consuming victim bandwidth to create a residential proxy network used for further malicious activities.

This is not theoretical. The model was intercepted while actively scanning for vulnerabilities and establishing proxy tunnels. The efficiency of an AI-driven agent allows attackers to scale reconnaissance and exploitation efforts far beyond traditional scripting capabilities. Defenders must evolve their monitoring to identify the subtle, high-velocity behavioral patterns characteristic of autonomous AI agents.

Technical Analysis

Threat Overview: The adversary has utilized a modified or prompted instance of a DeepSeek large language model (LLM) to function as an autonomous attack agent. Unlike standard botnets, this AI agent demonstrates dynamic decision-making capabilities during the attack chain.

Attack Chain:

1. Automated Reconnaissance: The AI agent autonomously enumerates exposed services and identifies potential entry points (weak credentials, unpatched services) across a vast IP space.
2. Initial Access: The agent leverages identified vulnerabilities or brute-forces credentials to gain a foothold on target hosts.
3. Proxyjacking: Once established, the agent deploys proxy software (often custom or repurposed binaries like 3proxy or SOCKS5 wrappers) to route malicious traffic through the compromised host.
4. C2 and Exfiltration: The host is integrated into a proxy network, obfuscating the origin of subsequent attacks (e.g., brute force, ransomware distribution) launched by the actor.

Affected Platforms: While the specific exploit vectors utilized by the AI may vary, the proxyjacking payload typically targets Linux-based servers (common in cloud infrastructures) and misconfigured Windows endpoints exposing RDP or SMB.

Exploitation Status:

• Confirmed Active Exploitation: Yes. Researchers intercepted the model during live operations targeting a security firm.
• Scale: Over 1,200 hosts were identified as targets in this specific campaign wave.

Detection & Response

Defending against AI-driven threats requires focusing on behavioral anomalies rather than static signatures. An AI agent often exhibits "superhuman" scanning speeds or logical patterns that differ from standard scripts.

SIGMA Rules

---
title: Potential Proxyjacking Activity - High Outbound Connections
id: 8c4f9d12-1a3b-4c5d-9e6f-7a8b9c0d1e2f
status: experimental
description: Detects processes establishing a high volume of outbound network connections, a common indicator of proxyjacking malware or AI agents tunneling traffic.
references:
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1090
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    EventID: 3
  filter:
    Initiated: 'true'
  condition: selection | count() > 50
  timeframe: 1m
falsepositives:
  - Legitimate update managers
  - High-bandwidth applications (e.g., streaming, backup)
level: high
---
title: Linux Proxyjacking - Suspicious Process Execution
id: 9d5e0f23-2b4c-5d6e-0f7a-8b9c0d1e2f3a
status: experimental
description: Detects execution of common proxy binaries often used in proxyjacking schemes (e.g., 3proxy, tinyproxy, brook) initiated by unusual parent processes.
references:
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1572
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/3proxy'
      - '/tinyproxy'
      - '/brook'
      - '/proxychains'
  selection_parent:
    ParentImage|endswith:
      - '/bash'
      - '/sh'
      - '/python'
  condition: all of selection_*
falsepositives:
  - System administrator configuration
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for AI-driven scanning patterns and Proxyjacking
// Focus on endpoints making connections to numerous unique external IPs
let TimeWindow = 1h;
let ConnectionThreshold = 50;
DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where ActionType == "ConnectionSuccess"
| where RemotePort !in (80, 443, 8080) // Exclude standard web browsing noise initially
| summarize TotalConnections=count(), DistinctIPs=dcount(RemoteIP), IPs=make_set(RemoteIP) by DeviceName, InitiatingProcessFileName
| where DistinctIPs > ConnectionThreshold
| extend AlertDetail = strcat("Device ", DeviceName, " connected to ", DistinctIPs, " unique IPs via ", InitiatingProcessFileName)

Velociraptor VQL

-- Hunt for proxy-related processes and listening sockets
-- indicative of proxyjacking compromise
SELECT 
  Pid, 
  Name, 
  Exe, 
  Username, 
  CommandLine
FROM pslist()
WHERE Name =~ 'proxy' 
   OR Name =~ '3proxy' 
   OR Name =~ 'tinyproxy'
   OR Name =~ 'privoxy'
   OR Name =~ 'socks'

-- Alternative: Hunt for processes listening on non-standard high ports (common proxy ports)
SELECT 
  Pid, 
  Family, 
  Address, 
  Port
FROM listen_sockets()
WHERE Port > 1024 AND Port < 65535
  AND Family = 2 // IPv4
GROUP BY Port
LIMIT 50

Remediation

Since this threat vector relies on the agent exploiting generic weaknesses (weak credentials, unpatched services) to install proxyware, remediation involves immediate isolation and hardening.

1. Isolation and Forensic Acquisition:

• Immediately isolate any host suspected of proxyjacking from the network to prevent it from being used as a hop for further attacks.
• Acquire a memory image to capture the AI agent's active process tree and any decrypted credentials in memory.

2. Remove Persistence and Payloads:

• Identify and terminate the proxy processes.
• Remove systemd services or Windows scheduled tasks created to maintain persistence.

3. Network Hardening:

• Implement strict egress filtering. Block outbound traffic from servers to non-essential ports. Proxy servers should only communicate with specific upstream nodes.

4. Vulnerability Management:

• Ensure all exposed systems are patched against the latest vulnerabilities. AI agents will prioritize low-hanging fruit; closing common exposure vectors (e.g., unpatched VPN gateways, exposed RDP) significantly reduces the attack surface.

Remediation Script (Bash for Linux):

#!/bin/bash
# Remediation script to identify and suspend common proxyjacking processes

echo "Scanning for common proxyjacking processes..."

# List of common proxyware binaries
PROXY_KEYWORDS=("3proxy" "tinyproxy" "brook" "proxychains" "privoxy" "socks5")

FOUND=0

for keyword in "${PROXY_KEYWORDS[@]}"; do
  PIDS=$(pgrep -f "$keyword")
  if [ ! -z "$PIDS" ]; then
    echo "[ALERT] Found process matching '$keyword': PIDs $PIDS"
    # Kill the process
    pkill -9 -f "$keyword"
    FOUND=1
  fi
done

if [ $FOUND -eq 0 ]; then
  echo "No known proxyjacking processes detected."
else
  echo "[ACTION] Suspicious processes terminated. Please review system services and startup scripts."
fi

# Check for unusual listening ports (example: >1024)
echo "Checking for high-port listening sockets..."
ss -tulwn | awk '$5 ~ /:[0-9]{4,}/' | grep LISTEN

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub