Chinese‑speaking actor uses DeepSeek‑powered Hermes Agent via Telegram for autonomous attacks
Unit 42 uncovered a Chinese‑speaking threat actor who leveraged the DeepSeek model through the open‑source Hermes Agent framework, controlled by simple Telegram commands, to automatically enumerate internet‑facing hosts and launch public exploits. The fully autonomous chain compressed weeks of manual targeting into minutes, proving that large‑language‑model‑driven weapons can operate with minimal human oversight.