Palo Alto Networks’ Unit 42 researchers have identified a Chinese-speaking threat actor using the DeepSeek AI model with the open-source Hermes Agent framework to autonomously scan, exploit and compromise vulnerable internet-facing servers with limited human involvement.
The activity was uncovered after the attacker’s AI agent accidentally exposed its own infrastructure, revealing API keys, exploit scripts, target lists and attack logs.
According to the researchers, the AI agent operated in an autonomous “Yolo” mode that allowed it to execute commands without requiring operator approval. The system was used to identify vulnerable targets, launch exploits and automate post-exploitation tasks.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs Had This To Say:
“Unit 42 caught this campaign because the AI agent accidentally started a file server from the attacker’s home directory and exposed everything. API keys, exploit scripts, target lists, session logs. The competent campaigns don’t self-expose.
“This was an unsophisticated operator with poor operational security. No zero-day discovery, no zero-day deployment. Every exploit was a public proof-of-concept pulled from GitHub for known Common Vulnerabilities and Exposures (CVEs).
“The entire stack was off-the-shelf, with DeepSeek as the reasoning engine, Hermes Agent for orchestration, and FOFA, a Chinese internet asset search engine similar to Shodan, connected through a Model Context Protocol (MCP) server. In one session with no further human input, the agent surveyed deployment counts across ten product families, selected the highest-value CVE by severity score and target volume, downloaded the exploit code, and started scanning.
“A single operator in Zhuhai attempted exploitation against over 460 systems across seven CVEs. The autonomous portion failed because target-side configurations happened to block the exploit chain. Happened to. A slightly less secure default on those n8n workflow automation instances and this would be a breach disclosure, not a research paper.
“That’s the unsophisticated version with commodity tooling and public exploits. A more capable threat actor running this same workflow discovers and deploys zero-days autonomously, without a human ever reviewing the exploit chain. When that capability intersects with ICS environments, the consequences shift from data theft to physical damage.
“I’ve built a Shodan MCP integration in about 30 minutes with an AI coding agent, and industrial control system (ICS) protocol MCP servers in a couple of hours. The attacker used a jailbroken DeepSeek instance, but they didn’t need to. I run Opus 4.6 for offensive security work, and it doesn’t stop you. The older and even open-source models are plenty strong with a solid harness around them. The barrier to autonomous hacking at scale is an afternoon and an API key or a decent GPU.
“This campaign burned through public CVEs with off-the-shelf tooling and still nearly succeeded. The next iteration finds zero-days on its own. Every quarter these models get more capable and cheaper to run. Organizations that aren’t aggressively shrinking their external attack surface and investing in detection and incident response now are going to learn that from an autonomous agent instead of a research paper.”
If I were you, I would look to see if you are a potential target. Because if you don’t, your adversaries will.
Liechtenstein Register of Beneficial Owners breach exposes data on 31K legal entities
Posted in Commentary with tags LI on August 3, 2026 by itnerdLiechtenstein disclosed that hackers gained unauthorized access to its Register of Beneficial Owners, copying data related to approximately 31,000 companies, foundations and trusts.
The government said the intrusion occurred during the night of July 29-30, after which authorities detected irregularities, took the system offline and launched an investigation.
According to the government, there is currently no evidence the data was altered or deleted, and no banks or customer banking data were affected. The register, established in 2021 as part of the country’s anti-money laundering framework, contains beneficial ownership information used to identify the individuals who ultimately own or control legal entities.
Denis Calderone, CTO, Suzu Labs Had This To Say:
“The AML register that was compromised holds immense value to anyone who gets their hands on it. Whoever holds that dataset holds the confidential information of who is actually behind the money of more than 31,000 registered companies, foundations, and trusts. Those entities chose Liechtenstein specifically for its secrecy, and now that info is in unknown hands. There’s no ransom demand, no dark web listing, no group has claimed it, so we can only speculate who did this and why. Even though attribution and motive are unknown, we can theorize on some potential threat actor categories and intents:
“Early reporting from Liechtenstein media indicates that two additional government portals built by the same software vendor were taken offline as a precaution after the breach, including the country’s mandatory VAT filing system. That points toward a potential supply chain or shared-infrastructure vulnerability rather than a targeted exploit against the beneficial ownership register itself. If the attack came through the vendor, then every system that vendor built is in scope, and the register just happened to be the most valuable thing sitting on the platform.
“That gets to the broader issue. The EU’s anti-money laundering directives required all EEA member states to build centralized beneficial ownership registers. The policy logic was sound: put all the ownership data in one place so regulators and law enforcement can trace who controls what. But consolidating that data into a single database also consolidated the target. Whoever did this had one system to focus on, one set of defenses to get past, and one exfiltration to walk away with the identities behind an entire country’s corporate and trust ecosystem. Governments building these registers need to defend them like the intelligence targets they are.”
You’re a target. You need to start to act like one. Consider this a textbook in terms of how not to get pwned.
Leave a comment »