Chinese actor used DeepSeek via Telegram to automate exploit selection

Intelligence Summary

Unit 42 reports a Chinese-speaking threat actor used DeepSeek through the Hermes Agent framework. The workflow began with a Telegram instruction to the agent. After that, the agent autonomously scanned for internet-facing systems and chose public exploits to run. Researchers did not find evidence of further operator input during the session. Organizations exposed services on the internet should review for unusual scanning and exploit activity.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics