knaithe: Inside an Autonomous AI-Driven Cyberattack Campaign

Published on August 7, 2026 | By Focused Hunts

A Chinese-speaking attacker known as knaithe has turned commercial artificial intelligence into a self-running attack machine. Instead of hunting for victims by hand, the attacker handed the work to an AI system that scans the internet, selects targets, and launches break-in attempts on its own. Security researchers watched it compress hundreds of hours of manual effort into minutes.

Think of it as a tireless robot locksmith set loose on a city. It walks down every street, tests thousands of doors, and pushes through the ones left unlocked, without a person guiding each step. Because the machine works around the clock and at massive scale, weak or unpatched systems get found and attacked faster than defenders can react.

The campaign has already reached real victims, including a government agency and several companies across three countries. The attacker stole data from exposed systems, took over active user sessions, and planted remote access on vulnerable servers. Any organization that leaves an internet-facing system unpatched now faces an attacker that can find and exploit that gap in minutes rather than weeks, raising the odds of data theft, account takeover, and deeper intrusion.

Hunting Controls & Observations

Organizations can detect this threat through telemetry that spans the endpoint, network, identity, and cloud domains:

Endpoint Controls: EDR/XDR platforms, Sysmon (Event 1 process creation, Event 3 network connection), Linux auditd or Sysmon for Linux, and PowerShell logging (Event IDs 4103 and 4104) on Windows targets.
Network Controls: Firewall and web proxy logs, DNS query logs, NetFlow, WAF/IPS alerts, and TLS inspection of outbound traffic to AI and messaging services.
Identity & Access Controls: Citrix NetScaler and VPN gateway authentication logs, Windows Security Event IDs 4624 and 4625, and Entra ID (Azure AD) sign-in logs.
Cloud & SaaS Controls: Egress monitoring for calls to consumer AI inference APIs, and container or workload logs for exposed application hosts.

Behavioral Indicators of Attack

The following behaviors indicate an AI-driven exploitation campaign in progress:

Inbound exploitation attempts against internet-facing applications (Langflow, n8n, Citrix NetScaler, Apache Tomcat, notebook servers, and VPN gateways) within hours of a public proof-of-concept release. (Network)
A single external source probing dozens of hosts with rapid version-enumeration requests over a few minutes. (Network)
Web-application, notebook, or VPN service processes spawning command shells or scripting interpreters, indicating remote code execution or a reverse shell. (Endpoint)
Server workloads making outbound connections to consumer AI inference APIs, messaging platforms, or unrecognized proxy endpoints. (Network / Cloud)
Reuse of a gateway session cookie (such as a NetScaler NSC_AAAC token) from a new IP address or hosting-provider network without a preceding interactive logon. (Identity)
A lightweight HTTP file server started from a user or worker home directory, staging exploit scripts and target lists. (Endpoint)
Exploitation activity across many unrelated vulnerabilities and products from the same source in a compressed timeframe, indicating automated target and tool selection. (Network / Endpoint)

MITRE Enterprise ATT&CK Tactics and Techniques

The campaign maps to the following MITRE ATT&CK techniques, sorted along the kill chain:

Reconnaissance (T1595.002 – Active Scanning: Vulnerability Scanning): The AI system enumerates software versions across many internet-facing hosts in parallel to find exploitable instances before selecting targets.
Reconnaissance (T1596.005 – Search Open Technical Databases: Scan Databases): The attacker queries internet-wide asset search engines through a custom integration to map exposed applications at scale.
Resource Development (T1588.005 – Obtain Capabilities: Exploits): Public proof-of-concept exploits are pulled from code-sharing repositories, ranked by severity and popularity, and staged for use.
Initial Access (T1190 – Exploit Public-Facing Application): Vulnerable internet-facing applications and gateways are exploited directly, with confirmed compromise of gateway appliances and notebook servers.
Execution (T1059 – Command and Scripting Interpreter): Successful exploits run operating-system commands and establish reverse shells from the compromised application context.
Credential Access (T1539 – Steal Web Session Cookie): The AI system searches appliance memory for gateway authentication cookies to hijack active, authenticated user sessions.
Command and Control (T1090 – Proxy): Traffic to Western AI tooling is routed through a third-party proxy to anonymize the operation and evade attribution.
Command and Control (T1102 – Web Service): A messaging platform orchestrates the autonomous agent and receives results, blending command traffic with legitimate web services.
Exfiltration (T1041 – Exfiltration Over C2 Channel): Data read from compromised gateway memory is exfiltrated through the established command-and-control path.

Controls' Observables

The detection opportunities below are organized by control category and linked to the techniques above. They emphasize behavior over static indicators, because the attacker rotates infrastructure and relies on legitimate services.

Endpoint Controls

Application runtime spawning a shell: A web-application, notebook, or VPN service process (java, python, node, or a gateway daemon) launches a command shell or interpreter.
Related MITRE Techniques: T1190, T1059. Detection Difficulty: MEDIUM.
Ad-hoc HTTP file server from a home directory: A simple file server (for example, a Python HTTP server) starts from a user or worker directory to stage exploit scripts and target lists.
Related MITRE Techniques: T1059, T1105. Detection Difficulty: LOW.

Network Controls

High-velocity version enumeration: One external source contacts many internal-facing hosts with rapid probe requests in a short window.
Related MITRE Techniques: T1595.002, T1596.005. Detection Difficulty: MEDIUM.
Server egress to AI and messaging services: Server or workload contexts reach consumer AI inference APIs, messaging platforms, or unrecognized proxies.
Related MITRE Techniques: T1090, T1102. Detection Difficulty: MEDIUM.
Rapid post-disclosure exploitation: Exploitation attempts against internet-facing applications appear within hours of a public proof-of-concept release.
Related MITRE Techniques: T1190. Detection Difficulty: MEDIUM.

Identity & Access Controls

Session cookie replay: A gateway session token is used from a new IP address or hosting-provider network with no preceding interactive logon.
Related MITRE Techniques: T1539. Detection Difficulty: HIGH.

Cloud & SaaS Controls

Exposed workloads calling external AI services: Internet-facing application workloads reach external AI or messaging endpoints during or after exploitation.
Related MITRE Techniques: T1102. Detection Difficulty: MEDIUM.

Insights and Recommendation

Organizations exploited in this campaign face memory data theft from gateway appliances, hijacking of authenticated remote-access sessions, and remote code execution that gives the attacker a foothold for lateral movement. Because target discovery and exploitation are automated, the window between a public vulnerability disclosure and a live exploitation attempt collapses from weeks to hours. Internet-facing systems left unpatched or running default configurations are the most likely to be compromised first.

Security teams should treat every newly disclosed critical vulnerability in an internet-facing application as actively exploited within hours and prioritize emergency patching for Langflow, n8n, Citrix NetScaler, Apache Tomcat, notebook servers, and VPN gateways. Detection should focus on web-application and notebook processes spawning shells (T1190, T1059), gateway session-cookie reuse from unexpected networks (T1539), and server workloads reaching consumer AI inference APIs or messaging services used for command and control (T1090, T1102). Correlating high-velocity external scanning (T1595.002) with follow-on exploitation attempts lets defenders catch these automated campaigns in the reconnaissance phase, before a foothold is established.

Source and Credits

This summary is based on Unit 42 (Palo Alto Networks)'s research article "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks" published on July 30, 2026.

Threat Hunting IOCs & Queries

The indicators below come from the cited Unit 42 research. Many are attacker-side infrastructure and tooling artifacts that support context and hunting hypotheses. Infrastructure rotates frequently, so the behavioral queries that follow provide more durable detection than static matching.

Known Indicators of Compromise

Attacker proxy endpoint: code.newcli[.]com (paths /codex/v1 and /ultra) – proxy used to route Western AI tooling and anonymize activity.
Contextual service endpoints (legitimate services abused as tooling, do not block): api.deepseek[.]com and dashscope.aliyuncs[.]com – consumer AI inference APIs called from the operator's infrastructure.
Authentication artifact: NSC_AAAC= – Citrix NetScaler session cookie targeted during memory-based session hijacking.
Host artifacts: fofoapi.py (custom asset-search script), langflow_poc.py (scanner), and a Python HTTP file server launched from the /home/worker directory.
Public exploit repositories leveraged: oscar-mine/CVE-2026-33017-Exploit, Chocapikk/CVE-2026-21858, and asaotomo/FofaMap.
Targeted vulnerabilities: CVE-2026-33017 (Langflow), CVE-2026-21858 and CVE-2025-68613 (n8n), CVE-2026-3055 (Citrix NetScaler, confirmed exploitation), CVE-2026-34486 (Apache Tomcat), CVE-2026-39987 (Marimo Notebook, confirmed exploitation), CVE-2026-0300 (PAN-OS User-ID), and CVE-2026-33824 (Windows IKE VPN).

IOCs current as of the source publication date (July 30, 2026). Threat actors frequently rotate infrastructure; prioritize the behavioral queries below for durable detection.

Application Runtime Spawning a Command Shell

Behavior Targeted: Detects an internet-facing application or notebook runtime (java, python, node, or a web server) spawning a command shell or interpreter, the hallmark of exploiting a public-facing application to gain code execution or a reverse shell.
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter)
Expected Results: Web, notebook, or VPN service processes as the parent of cmd, PowerShell, bash, or sh, often with reverse-shell command patterns or second-stage download commands.
False Positive Likelihood: MEDIUM
Tuning Guidance: Allowlist legitimate deployment, backup, and plugin automation by parent process and account. Correlate with an inbound exploit attempt immediately prior for higher fidelity.

Splunk SPL Query

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    ParentImage IN ("*\\java.exe","*\\python.exe","*\\python3*","*\\node.exe","*\\w3wp.exe","*\\httpd*","*\\nginx*","*\\tomcat*.exe")
    (Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\bash*","*/sh","*/dash")
        OR CommandLine IN ("*/dev/tcp/*","*bash -i*","*nc -e*","*curl*|*sh*","*wget*|*sh*"))
| eval susp_reason=case(match(CommandLine,"(?i)/dev/tcp/"),"reverse_shell_redirect",
    match(CommandLine,"(?i)\-i(\s|$)"),"interactive_shell", true(),"webapp_child_shell")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(CommandLine) as cmds
    by host, ParentImage, Image, User
| sort - count

// TUNING: Allowlist deployment/backup/plugin automation by ParentImage + User.
// TUNING: On Linux hosts, ingest Sysmon for Linux or auditd and map ParentImage to /usr/bin/java, /usr/bin/python3, node.
// FALSE POSITIVES: CI/CD agents and app plugins that legitimately shell out; correlate with a preceding inbound exploit attempt.

Microsoft KQL Query (Defender/Sentinel)

DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe","java","python.exe","python3","node.exe","node","w3wp.exe","httpd","nginx","tomcat.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","dash")
    or ProcessCommandLine has_any ("/dev/tcp/","bash -i","nc -e","curl","wget")
| extend Suspicion = case(
    ProcessCommandLine has "/dev/tcp/", "reverse_shell_redirect",
    ProcessCommandLine has "-i", "interactive_shell",
    "webapp_child_shell")
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine,10)
    by DeviceName, InitiatingProcessFileName, FileName, AccountName, Suspicion
| order by Count desc

// TUNING: Allowlist deployment/backup automation by InitiatingProcessFileName + AccountName.
// FALSE POSITIVES: App plugins and CI agents that spawn shells; correlate with a preceding inbound exploit attempt.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Server Workload Beaconing to AI APIs, Messaging, or Unknown Proxy

Behavior Targeted: Detects a server or workload making outbound connections to consumer AI inference APIs, messaging platforms, or an unrecognized proxy, consistent with an AI-agent operator using these services for reasoning and command-and-control.
MITRE ATT&CK: T1090 (Proxy), T1102 (Web Service)
Expected Results: Server-role hosts contacting AI or messaging endpoints they have no business reason to reach, especially when initiated by a web or application runtime.
False Positive Likelihood: MEDIUM
Tuning Guidance: Scope to server and DMZ subnets; user workstations calling AI APIs are expected. Maintain an allowlist of sanctioned AI endpoints and egress hosts.

Splunk SPL Query

index=* (sourcetype="stream:dns" OR sourcetype="zscaler" OR sourcetype="pan:traffic")
    (query IN ("*api.deepseek.com","*dashscope.aliyuncs.com","*api.telegram.org","*code.newcli.com")
        OR dest_host IN ("*api.deepseek.com","*dashscope.aliyuncs.com","*api.telegram.org","*code.newcli.com"))
| eval endpoint=coalesce(query,dest_host)
| eval category=case(match(endpoint,"telegram"),"messaging_c2",
    match(endpoint,"deepseek|dashscope"),"llm_inference",
    match(endpoint,"newcli"),"unknown_proxy", true(),"other")
| stats count values(endpoint) as domains min(_time) as firstSeen max(_time) as lastSeen
    by src_ip, category
| sort - count

// TUNING: Restrict src_ip to server/DMZ ranges; workstation AI usage is expected and noisier.
// FALSE POSITIVES: Sanctioned AI integrations. Allowlist approved AI endpoints and egress proxies.

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any ("api.deepseek.com","dashscope.aliyuncs.com","api.telegram.org","code.newcli.com")
| extend Category = case(
    RemoteUrl has "telegram", "messaging_c2",
    RemoteUrl has_any ("deepseek","dashscope"), "llm_inference",
    RemoteUrl has "newcli", "unknown_proxy",
    "other")
| summarize Count=count(), Domains=make_set(RemoteUrl,10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, Category
| order by Count desc

// TUNING: Focus on server-role devices; exclude sanctioned AI tooling by approved InitiatingProcessFileName.
// FALSE POSITIVES: Approved AI integrations and admin use. Weight higher when the initiating process is a server or web runtime.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

High-Velocity External Scanning From a Single Source

Behavior Targeted: Detects a single external source contacting many hosts with rapid probe requests in a short window, the signature of AI-accelerated mass scanning that precedes exploitation.
MITRE ATT&CK: T1595.002 (Active Scanning: Vulnerability Scanning)
Expected Results: One source IP touching dozens of distinct destinations within minutes, often across multiple ports or application endpoints.
False Positive Likelihood: MEDIUM
Tuning Guidance: Adjust the host count and time window to your external footprint. Allowlist approved external scanners, attack-surface-management vendors, uptime monitors, and CDNs.

Splunk SPL Query

index=* (sourcetype="pan:traffic" OR sourcetype="cisco:asa") action=allowed
| bin _time span=5m
| stats dc(dest_ip) as hosts_hit count as conns values(dest_port) as ports
    by _time, src_ip
| where hosts_hit > 25
| sort - hosts_hit

// TUNING: Raise/lower hosts_hit (25) and the 5m window to match your external exposure.
// FALSE POSITIVES: Approved vulnerability scanners, uptime monitors, and CDNs. Maintain a src_ip allowlist.

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where ActionType == "InboundConnectionAccepted"
| where not(ipv4_is_private(RemoteIP))
| summarize HostsHit=dcount(DeviceName), Conns=count(), Ports=make_set(LocalPort,20)
    by RemoteIP, bin(Timestamp, 5m)
| where HostsHit > 25
| order by HostsHit desc

// TUNING: Adjust HostsHit (25) and bin (5m) to fit your external exposure.
// FALSE POSITIVES: Legitimate internet scanners and monitoring. Enrich RemoteIP with reputation/ASN before escalating.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Gateway Session Cookie Reuse From an Anomalous Source

Behavior Targeted: Detects an authenticated remote-access session used from more than one IP address, consistent with stealing and replaying gateway session cookies harvested from appliance memory.
MITRE ATT&CK: T1539 (Steal Web Session Cookie)
Expected Results: A single session or correlation identifier associated with multiple source IPs or countries, especially where one is a hosting-provider network.
False Positive Likelihood: MEDIUM
Tuning Guidance: Requires a session or token identifier in gateway logs. For NetScaler-native logging, hunt the same pattern keyed on the NSC_AAAC session identifier. Weight hosting-provider ASNs and impossible-travel higher.

Splunk SPL Query

index=* (sourcetype="WinEventLog:Security" OR sourcetype="citrix:netscaler:*" OR sourcetype="pan:globalprotect")
    (EventCode=4624 OR action=success)
| iplocation src_ip
| stats dc(src_ip) as ip_count values(src_ip) as src_ips values(Country) as countries
    min(_time) as firstSeen max(_time) as lastSeen
    by user, session_id
| where ip_count > 1
| sort - ip_count

// TUNING: session_id must be the gateway session/token identifier; map to TargetLogonId or the appliance session field.
// FALSE POSITIVES: Mobile roaming and corporate egress changes. Prioritize hosting-provider ASNs and impossible travel.

Microsoft KQL Query (Defender/Sentinel)

SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| where AppDisplayName has_any ("Citrix","NetScaler","VPN","Gateway","Remote Access")
| summarize SessionCount=count(), IPs=make_set(IPAddress,20), IPCount=dcount(IPAddress),
    Countries=make_set(Location,10), MinTime=min(TimeGenerated), MaxTime=max(TimeGenerated)
    by UserPrincipalName, CorrelationId
| where IPCount > 1
| order by IPCount desc

// TUNING: Where gateway auth is federated to Entra ID, one session (CorrelationId) used from multiple IPs indicates token/cookie replay.
// FALSE POSITIVES: Legitimate IP changes (mobile, VPN egress). Prioritize hosting-provider ASNs and impossible travel.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Back to Hunting off the Red