Chinese Threat Actor Leverages AI to Target Exposed Infrastructure in Asia A Chinese-speaking threat actor, operating under the aliases knaithe and KnYuan and based in Zhuhai, China, has exploited large language models (LLMs) from both Chinese and Western providers to compromise internet-exposed digital infrastructure across Asia. According to a July 30 report by Unit 42, Palo Alto Networks’ threat intelligence team, the attacker used DeepSeek’s AI model and the Hermes Agent an open-source agentic AI framework to orchestrate the campaign via Telegram, significantly accelerating the speed and scale of their operations. The actor, described as an opportunistic exploit operator and self-proclaimed binary security researcher, combined AI-driven enumeration with automated and manual exploitation of seven vulnerabilities. Their GitHub activity, including the maintenance of 1DayNews an automated vulnerability intelligence pipeline revealed a methodical approach to identifying and weaponizing flaws. When initial exploitation attempts failed due to restrictive target configurations, the Hermes Agent, integrated with DeepSeek’s AI, autonomously searched for critical-severity CVEs across 10 product families. The AI scanned GitHub for trending proof-of-concept (PoC) exploits, prioritizing vulnerabilities based on attack surface before pivoting to seven higher-value flaws for targeted exploitation. This hybrid approach blending AI automation with manual refinement demonstrates an evolving threat landscape where adversaries increasingly rely on AI-augmented offensive tools to enhance efficiency and evade detection.