Chinese-Speaking Threat Actor Harnesses AI Models for Autono...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign
• Blog Title: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
• Suggested Section: AI Security > AI Assisted Fuzzing and Vulnerability Discovery / AI MCP Security, with subsections for autonomous reconnaissance-to-exploitation loops, unsafe agent permission configurations, and exploitability-prerequisite validation

🎯 Content Summary

Executive Summary

Unit 42 documented an AI-enabled offensive campaign operated by the Chinese-speaking actor knaithe/KnYuan, assessed to be based in Zhuhai, China. The actor combined autonomous vulnerability discovery and exploitation through DeepSeek and Hermes Agent with conventional manual operations using FOFA, custom Python scanners and direct exploit execution. The campaign maintained tooling for seven vulnerabilities and attempted to exploit more than ...

🔧 Technical Details

Autonomous vulnerability-discovery and exploitation loop: Combine an LLM reasoning engine with unrestricted terminal access, reusable offensive skills, Telegram C2 and an MCP server exposing internet-asset searches and scanner generation. The agent can translate a natural-language objective into FOFA queries, fingerprint products and versions, search public PoC repositories, download exploit code, execute scans, inspect failure conditions and automatically pivot. Settings such as dangerously-skip-permissions: true, approvalMode: "yolo", network_access = "enabled" and trusted executable directories remove client-side confirmation barriers, allowing Bash, file modification, network requests and agent spawning without per-action approval.

Exploitability-based target prioritization: Do not treat a vulnerable version as sufficient evidence of exploitability. Rank candidates by CVSS, internet deployment co...

🤖 Agent Actions

Updated src/AI/Web-Black-Box-AI-Pentester-Bots.md.

Added concise technical sections for:

• exploitability-first target pruning
• autonomous recon-to-exploitation loops
• unsafe agent permission profiles
• workspace exposure via python3 -m http.server

Also updated the ## References section with the Unit 42 blog URL.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign

Content Categories: Based on the analysis, this content was categorized under "AI Security > AI Assisted Fuzzing and Vulnerability Discovery / AI MCP Security, with subsections for autonomous reconnaissance-to-exploitation loops, unsafe agent permission configurations, and exploitability-prerequisite validation".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0