威胁行为者使用 DeepSeek 驱动的 Hermes 智能体攻击 Langflow 与 n8n (AML.CS0070)

一句话通俗理解

中文威胁行为者把 DeepSeek 接进 Hermes 智能体——终端、Telegram、浏览器全成攻击武器。

案例速览

事件经过

2026 年 5 月，一名中文威胁行为者（knaithe/KnYuan）将 Hermes 智能体配置为以 DeepSeek 为推理引擎，配备终端访问、Telegram 操控与浏览器自动化能力，对暴露的 Langflow 与 n8n 实例发起利用尝试——开源智能体框架正被快速武器化为攻击平台。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0070 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 生成式 AI (AML.T0016.002)

  The actor obtained access to several generative-AI models and services while evaluating an operational toolset. DeepSeek was selected as the primary reasoning engine for the autonomous attack activity.

S01

• 软件工具 (AML.T0016.001)

  The actor obtained and configured Hermes Agent as the offensive framework, together with scripts and conventional scanning and exploitation utilities. Hermes provided terminal access, Telegram-based operator control, and a skills system.

S02

• AI 智能体工具 (AML.T0016.004)

  The actor obtained agent-specific capabilities, including Hermes’s framework-bundled godmode skill and the open-source FofaMap MCP server. The MCP server exposed FOFA asset search, natural-language query translation, and Nuclei scan generation to DeepSeek. Unit 42 does not establish that godmode was invoked during the recovered session.

S03

• AI 智能体工具 (AML.T0017.002)

  The actor created two Hermes skills. web-terminal-exploitation encoded a procedure for unauthenticated WebSocket exploitation, while fofa-cyberspace-search instructed DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration. The observed FOFA workflow is consistent with the latter skill; the report does not attribute an action in the recovered session to web-terminal-exploitation.

S04

• AI 模型推理 API 访问 (AML.T0040)

  Hermes accessed DeepSeek through its native API and used the model for vulnerability assessment, target selection, command generation, and operational decisions.

S05

• 自主攻击路径适配 (AML.T0117)

  After receiving an initial task, DeepSeek sequenced reconnaissance and exploitation actions, evaluated failed prerequisites, abandoned Langflow, compared alternative products and vulnerabilities, and selected n8n. Unit 42 recovered no additional operator input during the session.

S06

• 生成恶意命令 (AML.T0102)

  DeepSeek generated FOFA queries, shell commands, scanner invocations, and direct HTTP probes based on the results returned during the session.

S07

• 自主侦察 (AML.T0116)

  DeepSeek investigated Langflow, determined what information and prerequisites were needed, and selected follow-on reconnaissance based on returned results.

S08

• 扫描数据库 (AML.T0000.003)

  DeepSeek queried FOFA and obtained records for 84 exposed Langflow instances. These were exposure records, not confirmed vulnerable targets.

S09

• 漏洞利用 (AML.T0016.003)

  DeepSeek downloaded a public PoC for Langflow CVE-2026-33017. The report does not establish material modification.

S10

• 主动扫描 (AML.T0006)

  DeepSeek ran the public Langflow scanner and identified a target running Langflow 1.3.4.

S11

• 利用面向公众的应用 (AML.T0049)

  DeepSeek attempted exploitation, but no target exposed either required prerequisite. No access was obtained.

S12

• 自主侦察 (AML.T0116)

  DeepSeek assessed Langflow as low value, surveyed exposure across 10 product families, compared vulnerability severity, deployment footprint, PoC availability, and prerequisites, and selected n8n.

S13

• 代码仓库 (AML.T0095.000)

  DeepSeek searched GitHub for trending 2026 CVE PoC repositories sorted by stars.

S14

• 漏洞利用 (AML.T0016.003)

  DeepSeek downloaded the public n8n PoC chaining CVE-2026-21858 and CVE-2025-68613 and inspected its affected versions and prerequisites.

S15

• 搜索开放技术数据库 (AML.T0000)

  DeepSeek queried FOFA for n8n deployments. FOFA reported 647,017 global results and 25,209 in China; these were not confirmed vulnerable systems.

S16

• 主动扫描 (AML.T0006)

  DeepSeek sampled approximately 100 Chinese addresses, probed roughly 40 unique systems, identified three running affected versions, inspected form endpoints, and launched parallel scanning against more than 50 remaining targets.

S17

• 利用面向公众的应用 (AML.T0049)

  DeepSeek attempted to find and exploit a system meeting the PoC prerequisites. All discovered forms required authentication, and no attempt produced file read, code execution, or initial access.

关联战术

• 资源开发 (AML.TA0003)
• AI 模型访问 (AML.TA0000)
• AI 攻击适配 (AML.TA0001)
• 侦察 (AML.TA0002)
• 初始访问 (AML.TA0004)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

• MITRE ATLAS 官方案例页 (AML.CS0070)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0