Analysis ai-infrastructuretechnology
knaithe/KnYuan: The Chinese Threat Actor Who Handed Autonomous Attack Operations to an AI
A Unit 42 investigation into a six-week exploitation campaign by a Chinese-speaking threat actor tracked as knaithe/KnYuan reveals the first confirmed attribution of a fully autonomous AI attack campaign: the operator delegated target selection, exploit selection, session initiation, and persistence attempts to DeepSeek and Hermes Agent running over Telegram — reducing their own role to reviewing results and adjusting a queue.