Threat Actor Uses DeepSeek and Hermes Agent to Run a 460-Target Autonomous Cyberattack Campaign

A China-based operator chained DeepSeek with the open-source Hermes Agent framework to autonomously identify vulnerabilities, select targets, download exploits, and launch attacks against more than 460 servers, compressing hundreds of hours of manual reconnaissance into minutes. Palo Alto Networks Unit 42 confirmed three successful compromises via a Citrix NetScaler vulnerability and flagged it as the first publicly documented LLM-driven end-to-end offensive operation.