Home › Threat Actors › knaithe/KnYuan
← All Threat Actors
Nation-State high China (Zhuhai-region infrastructure); moderate-to-high confidence on 'Chinese-speaking/China-based,' not formally state-attributed.

knaithe/KnYuan

Unit 42 (Palo Alto Networks) assesses with moderate-to-high confidence that the operator is a Chinese-speaking, China-based actor, based on infrastructure (shared Zhuhai-registered ASN space with prior KnYuan activity), Simplified Chinese-language operational artefacts, and a Chinese-language operator interface in the Telegram bot configuration. Unit 42 explicitly does not attribute knaithe to a specific PRC state organization and cannot distinguish state-directed, state-tolerated, or independent criminal operation. · Not firmly established. Prior KnYuan activity (opportunistic CVE scanning) is consistent with financially-motivated reconnaissance or data-gathering for sale to initial access brokers. The knaithe campaign's broad, non-sector-specific targeting is, per Unit 42, more consistent with opportunistic access-broker activity than the narrow intelligence-collection priorities typical of PRC state APT groups.

Reports 1
Active Since KnYuan scanning activity predates this campaign; the knaithe autonomous campaign ran for approximately six weeks before being exposed and documented by Unit 42 in August 2026
Last Reported 3 Aug 2026
Sectors Targeted ai-infrastructure, technology, financial-services, enterprise

Tactics, Techniques & Procedures (TTPs)

  • Autonomous AI-orchestrated attack pipeline: DeepSeek used as the reasoning backbone to evaluate exploit applicability and plan multi-step exploitation chains
  • Hermes Agent (open-source, Telegram-integrated agentic framework) used as the orchestration layer and operator console — tool invocation driven by model reasoning rather than manual operator steps
  • Curated 4-CVE-class toolkit: CVE-2026-33017 (Langflow pre-auth RCE), CVE-2026-21858 + CVE-2025-68613 (n8n auth bypass + RCE chain), CVE-2026-39987 (Marimo RCE), CVE-2026-3055 (Citrix NetScaler SAML auth bypass, used to reach otherwise-internal AI tooling)
  • Structured target queue (460+ targets) built from prior reconnaissance rather than real-time scanning
  • Prior KnYuan-identified activity: opportunistic, broad internet scanning for known CVEs from Zhuhai-registered ASN space

Known Targets

Technology companies/startups using AI workflow automationData science/analytics teams in financial services and enterpriseAI-native organisations running Langflow, n8n, or MarimoEnterprises using Citrix NetScaler combined with internal AI tooling460+ targets attempted; 3 confirmed compromises (~6-week campaign)

Analyst Notes

Campaign exposed via an operational security failure — an unprotected Python HTTP server on port 8888 on the actor's staging infrastructure leaked tool manifests, configuration files, and Chinese-language operational notes to Unit 42. Unit 42 frames this as the first confirmed, attributed instance of a fully autonomous (not merely AI-assisted) attack campaign.

Also Known As

KnYuan (Unit 42's prior identifier for prior opportunistic scanning activity from the same infrastructure)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1595.002 Active Scanning: Vulnerability Scanning T1102.002 Web Service: Bidirectional Communication T1588.006 Obtain Capabilities: Vulnerabilities

Intelligence Reports

Analysis ai-infrastructuretechnology

knaithe/KnYuan: The Chinese Threat Actor Who Handed Autonomous Attack Operations to an AI

A Unit 42 investigation into a six-week exploitation campaign by a Chinese-speaking threat actor tracked as knaithe/KnYuan reveals the first confirmed attribution of a fully autonomous AI attack campaign: the operator delegated target selection, exploit selection, session initiation, and persistence attempts to DeepSeek and Hermes Agent running over Telegram — reducing their own role to reviewing results and adjusting a queue.

3 Aug 2026 · 12 min read