Table of Contents
Introduction
Artificial intelligence is changing the world in many ways. But not all of these changes are positive. Cybersecurity researchers have discovered that hackers are now using a type of AI called DeepSeek to launch fully automated cyberattacks. This is a major step forward in how cybercriminals operate.
Hackers are now using AI to conduct cyberattacks without human involvement. This makes attacks faster and harder to stop.
What Is DeepSeek AI?
DeepSeek is a powerful AI model developed in China. It works similarly to other AI tools like ChatGPT. It can understand questions, write code, analyze information, and make decisions. This makes it incredibly useful for many legitimate purposes.
However, hackers have found a darker use for DeepSeek. They are using it to think like a human attacker. DeepSeek can analyze security weaknesses, choose which systems to attack, and even write the code needed to break into servers. All of this happens without a human giving detailed instructions.
Security researchers at Palo Alto Networks' Unit 42 discovered this activity. They found that a Chinese-speaking hacker group is behind these automated attacks. The group has been identified using the names "knaithe" and "KnYuan."
How Hackers Are Using DeepSeek
Here is how the automated attack process works:
- Step 1: The hacker gives a simple starting command. This could be something like "find vulnerable servers."
- Step 2: DeepSeek takes over. The AI searches the internet for exposed systems using an engine called FOFA.
- Step 3: DeepSeek analyzes the targets. It checks which systems have known vulnerabilities.
- Step 4: DeepSeek downloads exploit code. It finds and uses publicly available hacking tools.
- Step 5: DeepSeek attempts to break in. The AI tries to exploit the vulnerabilities it found.
What makes this scary is the speed. The AI can do in minutes what would take a human hacker many hours. It can scan thousands of systems, research vulnerabilities, and attempt attacks without stopping.
In one case, DeepSeek identified 84 vulnerable servers, found the right exploit code, and attempted attacks on all of them within minutes. No human interaction was needed.
The Hermes Agent Role
DeepSeek works together with another tool called Hermes Agent. This is an open-source AI framework that can interact with computer systems. It can:
- Run commands on servers
- Connect to the internet
- Receive instructions from Telegram (a messaging app)
- Operate in "Yolo" mode, which means it takes risky actions without asking for permission
In one case, Hermes accidentally created a web server that exposed all of the hacker's activity. This is how researchers discovered the campaign. They found API keys, exploit scripts, target lists, and AI attack logs.
Even though the automated attacks were not successful in this case, the campaign proves that hackers have a working system for AI-powered attacks. This technology is likely to improve and become more dangerous over time.
What Systems Are Being Targeted?
Researchers found that DeepSeek targeted multiple types of systems:
- Langflow servers (vulnerable to CVE-2026-33017)
- n8n workflow automation platforms (vulnerable to CVE-2026-21858 and CVE-2025-68613)
- Citrix NetScaler (vulnerable to CVE-2026-3055)
- Apache Tomcat
- Windows IKE VPN
- Marimo Notebook
In some cases, the hackers also conducted manual attacks. They successfully compromised systems using the Citrix NetScaler vulnerability. This allowed them to steal memory data and search for authentication cookies that could be used to hijack sessions.
How to Protect Your Business
The rise of AI-powered cyberattacks means businesses must take security more seriously than ever. Here are some steps you can take:
- Apply security updates immediately. Many of these attacks target known vulnerabilities. Patches are often available but are not applied in time.
- Monitor internet-exposed systems. Any system connected to the internet can be scanned and attacked by AI. Limit exposure where possible.
- Use strong access controls. Multi-factor authentication (MFA) and strong passwords make it harder for AI to break in.
- Conduct regular security assessments. Test your systems for vulnerabilities before hackers find them.
- Work with an experienced IT security partner. AI threats require advanced monitoring and response capabilities.
At SystemLogicIT, we help businesses stay ahead of emerging threats. Our cybersecurity experts can assess your systems and help you build a stronger defense.
Final Thoughts
The use of DeepSeek AI for autonomous cyberattacks is a warning for all businesses. Hackers are adopting new technologies faster than ever before. AI-powered attacks are faster, more efficient, and harder to stop.
This does not mean you should panic. It means you should take action. Apply security updates, monitor your systems, and work with experts who understand these threats.
Cybersecurity is no longer just about firewalls and antivirus software. It is about staying informed and staying ahead of the attackers. The future of cyberattacks is automated. Your defenses need to be ready.
If you need help protecting your business from AI-powered cyber threats, contact SystemLogicIT today for a free security assessment.