CA-26-029: “knaithe” AI-Orchestrated Cyber Attacks

Active Exploitation, AI-Orchestrated Attacks, RCE, Session Hijacking

Source Material: Unit 42, Sysdig | Technology: Citrix NetScaler, Marimo, n8n, Langflow  | Targeting: Global, Multiple Sectors including Government

Executive Summary

Security researchers are tracking an active campaign by a Chinese-speaking threat actor tracked as “knaithe” (or “KnYuan”). Operating from Zhuhai, China, this adversary uses large language models (LLMs) to automate initial access operations against network perimeter devices and data science infrastructure. Using the open-source Hermes Agent framework powered by the DeepSeek reasoning engine, knaithe successfully automated target reconnaissance and vulnerability enumeration. While the fully autonomous exploitation phase initially stalled against target-side authentication barriers, the AI-gathered intelligence enabled the actor to quickly pivot. Following the automated reconnaissance phase, the attacker actor launched manual exploitation efforts against perimeter appliances and server infrastructure (including Citrix NetScaler, Marimo, Apache Tomcat, and IKE VPN endpoints), resulting in confirmed data exfiltration, persistent reverse shells, and remote code execution (RCE).

Threat Overview and Strategic Impact

This campaign highlights the ongoing strategic shift of AI use in the threat landscape, as detailed in CA-26-026: Suspected Chinese State-Sponsored Intrusion Campaign Leveraging Split-Model Agentic AI Architectures and CA-26-027: OpenAI Frontier Agent Sandbox Escape & Hugging Face Intrusion. AI is no longer merely a static tool for writing phishing emails or basic scripts; instead adversaries now leverage agentic frameworks capable of autonomous reasoning, dynamic tool use, and continuous multi-step exploitation loops. This drastically lowers the barrier to entry for complex attacks and continues to shrink the already limited time between vulnerability disclosure and in the wild exploitation.

The knaithe campaign demonstrates an aggressive push to use AI to automate offensive operations. The actor maintains a custom GitHub repository (1DayNews) serving as a vulnerability intelligence pipeline that aggregates RCE disclosures from a variety of sources, processes them through the DeepSeek API for exploitability scoring, and pushes targeting alerts via Telegram. To obscure their origin and bypass LLM safety alignments, the actor reportedly routes traffic through a proxy service (code.newcli[.]com) and disables human-in-the-loop (HITL) approval requirements.

Researchers captured a complete autonomous multi-stage attack cycle, allowing deeper investigation into this activity. Triggered by a Telegram prompt, the DeepSeek-powered Hermes Agent executed a kill chain targeting Langflow (CVE-2026-33017). When exploitation failed due to configuration mismatches, the agent autonomously pivoted, researched higher-value targets via FOFA, selected the n8n platform, and acquired chained exploit code (CVE-2026-21858 and CVE-2025-68613).

When these automated loops encountered hard authentication blocks, the threat actor manually pivoted to conventional exploitation workflows targeting exposed perimeter infrastructure including CVE-2026-3055 (an unauthenticated memory over-read in Citrix NetScaler), CVE-2026-39987 (a pre-authentication RCE in Marimo Python notebooks), CVE-2026-34486 (Java deserialization reverse shell attempts against Apache Tomcat servers), and CVE-2026-33824 (reverse shell callbacks targeting Windows IKE VPN endpoints). By scraping Citrix process memory for NSC_AAAC= authentication cookies, the actor bypassed MFA to hijack sessions. On breached Marimo instances, they harvested AWS credentials and deployed a variant of the NKAbuse Go-based backdoor.

Security Hardening and Recommendations

Autonomous AI agents execute decision loops (scanning, analyzing code, retrieving GitHub PoCs, evaluating target feasibility, and attempting exploits) in seconds rather than days, outpacing defenders who are still relying solely on manual triage or static IOC signatures. By targeting the operational speed, resource consumption, and decision-making mechanisms of agentic AI, organizations can disrupt the attack chain before the autonomous loop reaches the exploitation stage.

To build resilience against agentic AI attack loops, Deepwatch recommends the following hardening:

• Shift to Continuous Exposure & Attack Surface Management: Autonomous agents rely on internet wide asset scanners (such as FOFA, Shodan, and Censys) to harvest targets at scale.
  • Eliminate Exposure & Enforce Authentication: AI agents target path-of-least-resistance vulnerabilities such as default configurations, auto-login features, and unauthenticated developer instances (e.g., n8n, Langflow, or Marimo notebooks). Enforcing strict authentication defaults across all endpoints prevents unauthenticated probing and halts the agent’s automated attack sequence at the initial access stage.
  • Hide Behind Zero Trust & SASE: Remove edge appliances, developer tools, and administrative interfaces from the public internet. Routing these platforms behind Zero Trust Network Access (ZTNA) or SASE solutions with step-up MFA helps defend against an agent’s automated enumeration phase.
• Implement Deception & “Reasoning Delay” Strategies: A weakness of an autonomous AI agent is its reliance on processing incoming target data to decide its next step. Defenders can leverage this to insert friction into the agent’s reasoning.
  • Deploy High-Interaction Honeypots & Canaries: Place honeypot endpoints and synthetic vulnerability markers on your perimeter. When an AI agent ingests fake target data, it wastes compute tokens and execution time trying to exploit non-existent software while allowing immediate triggering of high-fidelity alerts.
  • Dynamic Throttling & Anti-Automation Rate Limiting: Enforce strict request rate limits on public HTTP/API endpoints. Slowing down responses forces the agent to experience timeouts or consume excess API tokens and can slow or break its automated scan-and-pivoting chain.
• Deploy Machine-Speed Behavioral Detection & Automated Containment: Human security operations center (SOC) analysts alone cannot match the execution velocity of an autonomous agent running dozens of exploit threads simultaneously.
  • Behavioral Anomaly Baselining: Shift detections toward behavioral and velocity observations rather than relying solely on file hashes or IP addresses. Look for rapid sequential API calls, automated process execution chains (e.g., sudden local HTTP servers like python -m http.server), and multi-endpoint version probing within short timeframes. Deepwatch’s Dynamic Risk Scoring (DRS) helps continuously weigh these individual low-severity behaviors and observations into an aggregated, high-fidelity risk score.
  • Automated Active Response: Combat machine-speed attacks with Deepwatch’s Active Response. Define automated playbooks that allow the immediate isolation of endpoints, revoke session tokens, or apply temporary firewall blocks when machine-velocity scanning threshold rules are triggered.
• Harden Session Integrity against Process Memory Extraction: In recently observed campaigns attackers used automated memory dumps to harvest authentication tokens (e.g., Citrix NSC_AAAC= cookies) for session hijacking.
  • Demonstrating Proof-of-Possession (DPoP): Transition to cryptographically bound session tokens (such as OAuth 2.0 DPoP) that tie access tokens to the specific client private key, ensuring stolen memory strings cannot be replayed from attacker infrastructure.
  • Strict IP-to-Session Binding & Short Lifespans: Configure session management to tie active user sessions to verified IP ranges and client fingerprints, while enforcing aggressive session expiration times for edge remote-access appliances.
• Secure Internal AI Architectures & Model Frameworks: If your organization deploys internal AI agents, developer tools, or Model Context Protocol (MCP) integrations, harden the execution environment against agent hijack or misuse.
  • Least Privilege for AI Tools & Terminal Access: Restrict agentic execution frameworks to isolated sandboxes. Never grant AI agents unconstrained terminal privileges or full read/write/execute rights on host file systems without explicit human-in-the-loop approvals.
  • MCP Server Hardening: Require strict authorization for all Model Context Protocol (MCP) integrations, allowlisting only authorized tool commands and restricting outbound network connections from the agent workspace.

Detection Strategy

• Host & AI Tooling Artifact Detections (EDR/SIEM): Agentic AI frameworks typically require specific command-line arguments, environment configurations, and local execution paths to bypass safety controls and operate autonomously.
  • Bypass & Unrestricted Mode Detection: Query EDR logs for CLI invocations or environment variables that grant unconstrained terminal execution or disable client-side safeguards:
    • –dangerously-skip-permissions or explicit tool allowlisting (Bash, file_io, agent_spawning).
    • CLAUDE_CODE_ATTRIBUTION_HEADER: 0 or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: 1.
    • approvalMode: “yolo” or disable_response_storage = true.
  • Anomalous LLM Proxy Egress: Audit corporate network egress and DNS logs for connections to multi-model proxy domains (code.newcli[.]com) or non-standard external AI model endpoints (api.deepseek[.]com, dashscope.aliyuncs[.]com) originating from developer workstations or server environments.
• Machine-Velocity Reconnaissance & Exploit Acquisition (Network / WAF): Unlike human operators who may pause to read documentation, AI agents issue rapid, scripted sequences to query Internet-exposed asset search engines (like FOFA, Shodan, or Censys), pull public GitHub PoCs, and probe endpoints simultaneously.
  • Rapid Multi-Endpoint Probing: Configure WAF and API gateways to trigger high-fidelity alerts when a single client IP or TLS fingerprint conducts rapid sequential version checking across multiple distinct paths (e.g., /api/v1/n8n, /langflow/health, /marimo/run) within tight time windows.
  • Scripted Exploit Download & Execution: Monitor endpoint file integrity and execution logs for rapid git clone, curl, or wget activity targeting public exploit repositories (e.g., GitHub PoC repos) immediately followed by subshell script execution (python3 langflow_poc.py, python3 fofoapi.py).
• Ephemeral Staging & Non-Standard Local Web Servers (EDR): As observed in recent reporting agents frequently spin up local web or file servers to stage payload delivery or expose directory contents, often inadvertently exposing their workspace.
  • Ad-Hoc HTTP Server Instantiation: Create EDR detection rules targeting built-in interpreter web server commands executed outside authorized web roots or within staging directories:
  • python3 -m http.server, python -m SimpleHTTPServer, php -S, or npx http-server.
  • Execution from paths like /home/worker/, /tmp/, /dev/shm/, or user home directories.
  • Unusual Tool Process Chains: Alert on processes where an AI agent framework or terminal daemon spawns active network reconnaissance scripts or background network listeners.
• Process Memory Dumping & Session Hijacking (EDR & Identity): When autonomous initial access fails or yields partial credentials, agents resort to memory dumping to extract active session tokens (such as Citrix NSC_AAAC= cookies).
  • LSASS & Edge Appliance Process Memory Access: Deploy host-based rules detecting unauthorized processes or scripts attempting read/dump operations against process memory space (e.g., NetScaler processes or LSASS memory reads).
  • Impossible Travel & Session Cookie Anomaly Rules: Monitor Identity Provider (IdP) and SASE logs for active session cookie reuse across mismatched geographic locations, Autonomous System Numbers (ASNs), or varying HTTP User-Agent headers within unrealistic timeframes.
• Deception Detections (Honey Infrastructure): AI agents often automate target harvesting by parsing public asset indices, as a result, they are often vulnerable to deception traps.
  • Honeypot Endpoints: Deploy lightweight honeypot endpoints mimicking vulnerable developer or automation tools (e.g., fake n8n or Langflow landing pages) exposed to public indexing engines. Alert on any automated scan or exploit attempt hitting these endpoints.
  • Honey Tokens in Source Code: Place synthetic API keys, fake environment variables, or honey tokens in exposed test repositories. When an AI agent autonomously searches GitHub for credentials or PoCs and attempts to test the honey credential, trigger an immediate alert.

How Deepwatch Protects Our Customers

Deepwatch provides end-to-end defense against machine-speed, AI-orchestrated threat campaigns through a combination of expert-led operations and automated response capabilities:

• 24/7 Continuous Expert Monitoring: Deepwatch experts continuously monitor customer environments around the clock to detect, investigate, and triage suspicious activity in real time.
• Threat Intelligence & Analysis: Our Threat Intelligence team actively tracks, collects, and analyzes evolving adversary TTPs and IOCs, to provide early awareness of emerging agentic AI attack trends.
• Continuous Detection Engineering: Detection Engineers constantly review, update, and deploy high-fidelity alerting to keep pace with the latest threat landscape evolutions.
• Proactive Threat Hunting: Deepwatch Threat Hunters regularly perform IOC retrohunts across historical customer telemetry to identify latent threat activity or newly disclosed indicators.
• Dynamic Risk Scoring (DRS): Deepwatch DRS continuously correlates and weighs individual low-severity behavioral signals into an aggregated, high-fidelity risk score to elevate critical threats automatically.
• Automated Active Response: To counter machine-velocity attack loops, Deepwatch Active Response can execute automated playbooks that isolate compromised endpoints or revoke hijacked session tokens before initial access turns into deep intrusion.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity.

Threat Hunting Leads

• Autonomous “YOLO Mode” CLI Flags & Safeguard Disabling
• Hypothesis: Threat actors configuring AI coding agents or terminal frameworks (e.g., Claude Code, Cursor, Hermes Agent, Qwen Code) for unattended execution will set specific environment variables or CLI flags to skip interactive confirmation prompts.
• Data Sources: EDR Process Command-Line Logs, Command History (.bash_history, .zsh_history), Environment Configuration Audits.
• Hunt Logic:
  • Query command-line process arguments for permission bypass flags:
    • –dangerously-skip-permissions
    • approvalMode=”yolo”
    • CLAUDE_CODE_ATTRIBUTION_HEADER=0
    • CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
    • disable_response_storage=true
  • Inspect process trees where an AI CLI binary or terminal agent acts as a parent process spawning system shells (bash, sh, powershell.exe) or compilation tools (gcc, pip, npm).

• Machine-Velocity “Scan-Fetch-Exploit” Execution Loops
  • Hypothesis: An autonomous AI agent running target discovery, GitHub PoC retrieval, code evaluation, and exploit execution will complete these steps in compressed timeframes without typical human operational pauses.
  • Data Sources: EDR File System Events, Web Proxy Logs, Host Network Connection Logs.
  • Hunt Logic:
    • Look for a rapid sequence (e.g., <= 60 seconds) on a single host involving:
      • Outbound HTTP request to code/asset platforms (github[.]com, fofa[.]info, shodan[.]io).
      • Rapid file creation of a script or executable in temporary directories (/tmp, /var/tmp, AppData\Local\Temp).
      • Outbound network socket creation across multiple distinct target IPs on identical port paths.
      • Immediate file modification or deletion of the script following an execution failure, followed by a new download attempt.
• Abuse of Model Context Protocol (MCP) & Red-Teaming Extensions
  • Hypothesis: Attackers integrate Model Context Protocol (MCP) tools and custom red-teaming skills into AI agents to connect LLM natural language capabilities directly to network enumeration tools and exploit frameworks.
  • Data Sources: Host File Integrity Monitoring (FIM), EDR Process Execution, Local Inter-Process Communication (IPC) Logs.
  • Hunt Logic:
    • Audit host systems for execution of MCP servers associated with asset discovery or exploitation (e.g., FofaMap, Shodan-MCP, Nuclei-MCP).
    • Search local network logs for localhost HTTP/API traffic (127.0.0[.]1:8080, 127.0.0[.]1:5000) passing JSON-RPC payloads containing target queries, vulnerability checks, or command strings.
• Unintentional Web Server Instantiation in Workspace Directories
  • Hypothesis: Threat actors running autonomous AI agents (such as Hermes Agent) on staging hosts may inadvertently execute built-in web servers from non-standard workspace paths, exposing internal tools, logs, or payload directories.
  • Data Sources: EDR Process Execution Logs (Sysmon Event ID 1 / Auditd), Network Connections (Sysmon Event ID 3 / NetFlow).
  • Hunt Logic:
    • Query for built-in interpreter web server executions: python3 -m http.server, python -m SimpleHTTPServer, php -S, ruby -run -e httpd, or npx http-server.
    • Filter results for non-standard execution paths: /home/worker/, /tmp/, /dev/shm/, or user home directories.
    • Look for active listening sockets on high-number non-standard ports (e.g., 8888, 8080, 8000).
• Multi-Model AI Proxy Egress & Direct Model API Access
  • Hypothesis: Attackers tunneling LLM traffic through commercial proxy services to bypass provider safety filters or regional restrictions generate distinct DNS and TLS proxy egress traffic.
  • Data Sources: Web Proxy / SASE Logs, Firewall Egress, DNS Query Logs.
  • Hunt Logic:
    • Search DNS and HTTP proxy logs for connections to known multi-model proxy infrastructure: code.newcli[.]com (specifically URIs containing /codex/v1 or /ultra).
    • Query for high-volume or recurring outbound API connections to direct LLM endpoints originating from non-developer server environments: api.deepseek[.]com and dashscope.aliyuncs[.]com.
    • Identify unusual non-browser parent processes (e.g., Python interpreters, terminal daemons, background scripts) initiating these outbound TLS handshakes.
• Process Memory Extraction & Cookie Replay
  • Hypothesis: The threat actor uses memory read exploits against edge appliances (e.g., Citrix NetScaler) and parses dumped process memory for session strings (NSC_AAAC=) to attempt session hijacking.
  • Data Sources: Edge Appliance Logs (NetScaler / VPN), Identity Provider (IdP) Sign-in Logs, WAF Access Logs.
  • Hunt Logic:
    • Search perimeter appliance logs for crash reports, abnormal process memory dumps, or out-of-bounds read errors associated with CVE-2026-3055.
    • Query IdP and web access logs for authentication events where active session tokens (NSC_AAAC=) are used from an IP address, Autonomous System Number (ASN), or HTTP User-Agent that differs from where the session was established.

Technical Artifacts 

Please visit the Guardian Platform to access the associated technical artifacts.

Threat Object Mapping

Intrusion Set:

•  knaithe / KnYuan (Unattributed Chinese-speaking threat actor)

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Reconnaissance	Active Scanning: Vulnerability Scanning	T1595.002	Probing target perimeter endpoints (Langflow, n8n, Citrix) for vulnerable versions.
Reconnaissance	Search Open Technical Databases	T1596.005	Executing automated FOFA queries to discover internet-exposed target infrastructure.
Reconnaissance	Search Open Websites/Domains	T1593	Aggregating RCE disclosures across vendor sources and feeds via the 1DayNews pipeline.
Resource Development	Obtain Capabilities: Exploits	T1588.005	DeepSeek autonomously querying and downloading trending CVE PoC code from GitHub.
Resource Development	Acquire Infrastructure: Web Services	T1583.006	Utilizing commercial multi-model proxies (code.newcli[.]com) for operational evasion and model access.
Initial Access	Exploit Public-Facing Application	T1190	Exploiting Citrix NetScaler (CVE-2026-3055) and Marimo Notebooks (CVE-2026-39987).
Execution	Command and Scripting Interpreter: Python	T1059.006	Executing custom FOFA tools, staging local web servers, and running exploit threads.
Execution / Privilege Escalation	AI Agent Tool Invocation	AML.T0053	Equipping DeepSeek inside Hermes Agent with terminal access, bash execution, and MCP server extensions (FofaMap-Platinum-Full-Expert).
Privilege Escalation / Defense Evasion	LLM Jailbreak	AML.T0054	Employing the bundled “godmode” red-teaming skill within the Hermes Agent framework to bypass system prompts and safety alignments.
Credential Access	Steal Web Session Cookie	T1539	Scraping Citrix process memory for NSC_AAAC= cookies to execute session hijacking.
Command and Control	Web Service: Bidirectional Communication	T1102.002	Orchestrating the autonomous Hermes Agent via Telegram bot interaction channels.
Command and Control	Proxy: Multi-hop Proxy	T1090.003	Routing LLM traffic through proxy infrastructure (code.newcli[.]com) and using anonymizing proxies during targeted intrusions.
Defense Evasion	Impair Defenses: Disable or Modify Cloud Logs / Event Logging	T1562.008 / T1562.002	Disabling local LLM response storage and logging options to minimize forensic artifacts.
Defense Evasion	Indicator Removal: File Deletion	T1070.004	Deleting local exploit directories and batch target lists after active operations.

Vulnerabilities:

• CVE-2026-3055 (Citrix NetScaler ADC/Gateway Memory Over-read)
• CVE-2026-39987 (Marimo Python Notebook Pre-Auth RCE)
• CVE-2026-33017 (Langflow RCE – Attempted)
• CVE-2026-21858 & CVE-2025-68613 (n8n Chained Flaws – Attempted)
• CVE-2026-34486 (Apache Tomcat Java Deserialization)
• CVE-2026-33824 (Windows IKE Extensions VPN RCE)

Malware/Tool:

• Hermes Agent / DeepSeek: AI orchestration and reasoning engines.
• FofaMap-Platinum-Full-Expert: MCP server used for automated reconnaissance.
• NKAbuse: Go-based backdoor deployed on compromised hosts.

Additional Sources

• Picus Security: CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler Memory Overread
• Broadcom: CVE-2026-39987 – Marimo RCE Vulnerability
• Cloud Security Alliance: LLM-Orchestrated Kill Chains: From CVE to Database Breach in Four Pivots
• Palo Alto Networks: OWASP Agentic Top 10 Survival Guide

↑