Full research report
Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
Executive assessment
The strongest evidence supports a mixed campaign rather than the headline's simpler implication of wholly autonomous successful attacks. DeepSeek-driven activity autonomously selected targets, obtained public exploit material and changed direction after failure, but the recovered Langflow and n8n attempts did not compromise their targets. Confirmed impact came from separate manual exploitation of NetScaler and Marimo, and both products have narrowly defined exposure conditions and vendor fixes. The principal unresolved issue is Unit 42's inconsistent accounting of three successful exploitations versus three NetScaler targets plus 11 Marimo endpoints with confirmed command execution.
What happened
Unit 42 reported on 30 July 2026 that a Chinese-speaking operator using the aliases knaithe and KnYuan combined autonomous DeepSeek-driven activity with conventional manual exploitation against more than 460 targets. In a recovered 7 May session, the autonomous workflow attempted CVE-2026-33017 against Langflow, then pivoted to an n8n chain using CVE-2026-21858 and CVE-2025-68613; neither path achieved compromise because required exposure and configuration conditions were absent. Separate manual activity reportedly exfiltrated memory from three NetScaler targets and executed commands on 11 Marimo endpoints.
Affected scope
The reported activity covered Langflow through 1.8.2, n8n versions affected by CVE-2026-21858 and CVE-2025-68613, Marimo through 0.20.4, and vulnerable customer-managed NetScaler ADC or Gateway builds configured as Security Assertion Markup Language identity providers. Unit 42 also associated manual attempts with Apache Tomcat CVE-2026-34486, Windows Internet Key Exchange CVE-2026-33824 and a non-functional research copy for PAN-OS CVE-2026-0300. Targeting was opportunistic across internet-facing systems, although repeated activity against a Malaysian government entity showed greater intent.
Technical assessment
The autonomous workflow used internet asset discovery, version checks and public exploit repositories to rank and attempt known vulnerabilities without further recovered operator input. Langflow exploitation required a usable public flow context, while the attempted n8n chain required an unauthenticated form with file upload; the examined systems lacked those conditions. Confirmed manual impact involved a NetScaler out-of-bounds memory read used to search exposed memory for authentication cookies and a missing Marimo terminal WebSocket authentication check that permitted command execution.
Recommended defensive actions
- Immediately patch Langflow to 1.9.0 or later and remove unnecessary public access to flow-building interfaces.
- Upgrade n8n to 1.122.0 or later, restrict public webhook and form endpoints, and verify that exposed forms require authentication.
- Update Marimo to 0.23.0 or later and restrict notebook and terminal interfaces to trusted networks.
- Apply the fixed NetScaler builds listed in CTX696300 and audit configurations for SAML identity-provider profiles.
- Hunt for reconnaissance and exploit attempts against Langflow public-flow routes, n8n form or webhook endpoints, Marimo terminal WebSockets and NetScaler SAML identity-provider interfaces.
- Review NetScaler telemetry and incident records for anomalous memory-read activity, repeated requests, authentication-cookie abuse and suspicious sessions.
- Inventory all internet-facing workflow, notebook and perimeter-management services and remove exposure not required for business operations.
Uncertainties and evidence gaps
- Unit 42 states that command execution was confirmed on 11 Marimo endpoints and data was exfiltrated from three NetScaler targets, but also refers to three successful exploitations; the published report does not clearly reconcile target, organisation and exploitation counts.
- The recovered autonomous record ended after unsuccessful n8n attempts, so it does not establish whether later autonomous sessions compromised other systems.
- Unit 42 attributes the operator to Zhuhai, China, but the public aliases and profile information do not establish a legal identity or state affiliation.
- The current n8n CVE-2025-68613 advisory presentation contains inconsistent affected and patched-version metadata; upgrading to 1.122.0 or later is the least ambiguous vendor-stated remediation.
- The number and identity of hosts in a deleted batch-exploitation target file remain unknown.
- The supplied reporting identifies CVE-2026-3055, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-39987, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed exploitation in this campaign affected three NetScaler targets and 11 Marimo endpoints; autonomous Langflow and n8n attempts failed, while public exploit code was available.
The investigation began by testing whether the headline represented successful autonomous compromise or a broader campaign mixing autonomous and manual activity. The primary research showed that the recovered Langflow and n8n session failed, while separate conventional operations produced confirmed NetScaler and Marimo impact. Vendor advisories and CISA records independently validated the principal vulnerabilities, exposure conditions and remedies, but the exact successful-target count remains internally inconsistent.
- What event and timeline does the supplied report describe?Read the supplied article and separated the recovered May autonomous session from the manual exploitation activity reported in July.thehackernews.com ↗
The autonomous Langflow and n8n attempts failed, while manual NetScaler and Marimo activity reportedly achieved impact; the article also identified a contradiction in the success count.
why This prevented the failed autonomous attempts from being misreported as successful autonomous compromise.
- What does the originating research actually establish?Reviewed the complete Unit 42 campaign report, its exploitation table, session reconstruction, targeting analysis and attribution section.unit42.paloaltonetworks.com ↗
Unit 42 linked eight CVEs to seven exploit tracks, documented more than 460 attempted targets, confirmed NetScaler data exfiltration and Marimo command execution, and found no successful Langflow or n8n compromise in the recovered session.
why This established the campaign's evidenced operational scope and distinguished autonomous from manual activity.
- Is CVE-2026-33017 independently recognised as exploited and what versions are affected?Reviewed the National Vulnerability Database record and its CISA Known Exploited Vulnerabilities information.nvd.nist.gov ↗
The record describes unauthenticated Langflow code injection, identifies a fix in 1.9.0 and records CISA catalogue inclusion on 25 March 2026.
why This independently corroborated the vulnerability and broader exploitation status, although it did not attribute that exploitation to this operator.
- What are the authoritative Langflow scope and fix?Read the Langflow project security advisory.github.com ↗
Langflow through 1.8.2 is affected and version 1.9.0 is patched; the flaw arises because a public build route can accept executable supplied flow data without authentication.
why This supplied a vendor-backed remediation and explained why a suitable public-flow context mattered.
- What did the first n8n flaw contribute to the attempted chain?Read the n8n advisory for CVE-2026-21858.github.com ↗
Certain form-based workflows could expose server files to an unauthenticated remote party in versions from 1.65.0 before 1.121.0; restricting public forms is the temporary mitigation.
why This confirmed both the file-access stage and the public-form prerequisite that blocked the observed attempt.
- What is the n8n code-execution risk and safest fixed release?Read the n8n advisory for CVE-2025-68613.github.com ↗
Insufficiently isolated workflow expressions can permit code execution, and the advisory text recommends version 1.122.0 or later, although its displayed version metadata is inconsistent.
why This supported the second stage of the reported chain while requiring a conservative remediation recommendation and an explicit uncertainty.
- Which NetScaler configurations and builds are affected?Read Citrix bulletin CTX696300.support.citrix.com ↗
CVE-2026-3055 is a memory over-read affecting customer-managed NetScaler ADC or Gateway appliances configured as SAML identity providers; Citrix lists fixed 14.1, 13.1 and FIPS/NDcPP builds.
why This narrowed exposure to a specific configuration and provided concrete patch targets.
- Does the Marimo advisory support pre-authentication command execution and the reported fix?Reviewed the Marimo project advisory and its technical description.github.com ↗
A terminal WebSocket omitted an authentication check, allowing pre-authentication shell access in affected releases; version 0.23.0 is patched.
why This independently supported the mechanism behind the campaign's confirmed Marimo command execution.
- Is Marimo exploitation independently confirmed beyond the campaign report?Checked the filtered CISA Known Exploited Vulnerabilities catalogue entry.cisa.gov ↗
CISA added CVE-2026-39987 on 23 April 2026 as a vulnerability exploited in the wild and directs organisations to apply vendor mitigations.
why This raises remediation priority but does not by itself identify the campaign operator or victims.
- Was public Langflow exploit code genuinely available?Opened the public repository named by the research and checked that it contained exploit code for CVE-2026-33017.github.com ↗
The repository exists and contains public exploit code targeting affected Langflow releases.
why This verified proof-of-concept availability without treating availability alone as evidence of successful exploitation.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1656 records | Primary evidence5 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok8 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context4 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok669 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1006 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 12 opened outside the registered collection
Vulnerability & exploitation8
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
Technical references4
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code2
Public exploit code for the Langflow flaw that the autonomous workflow attempted to use.
Vendor-hosted technical advisory includes proof-of-concept material and documents the missing WebSocket authentication check.
Vendor & gov advisories7
Confirms CVE-2026-33017 affects Langflow through 1.8.2 and is patched in 1.9.0.
Confirms CVE-2026-21858 affects versions from 1.65.0 before 1.121.0 and can expose server files through certain public forms.
Confirms CVE-2025-68613 can produce code execution through insufficiently isolated workflow expressions and recommends 1.122.0 or later.
Confirms CVE-2026-3055 is a critical memory over-read affecting customer-managed appliances configured as SAML identity providers and lists fixed builds.
Confirms CVE-2026-39987 affects Marimo through 0.20.4 and is patched in 0.23.0.
Independently confirms exploitation of the Marimo vulnerability in the wild and records its addition on 23 April 2026.
Corroborates the Langflow code-injection mechanism, critical severity, fixed release and CISA catalogue status.
Analysis & research2
Primary investigation documenting the recovered May 2026 session, manual campaigns, affected CVEs, targeting and observed impact.
Independent reporting highlights an unresolved inconsistency in the primary report's successful-target count.