Every major cyberattack has a story behind it. A vulnerability no one patched. A phishing email someone clicked. A nation-state with a motive. Dark Perimeter goes beyond the headlines to explore the true stories of the hacks, breaches, and cyber operations that shaped history - told in narrative form for security professionals and curious minds alike. No guests, no panels, no filler. Just the story.
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
0:00
|
16:31
Six hundred and forty seven thousand internet-exposed n8n instances, counted by software that then decided, on its own, which ones were worth attacking. We know that because the attacker's agent started a file server in its home directory and served its operator's entire environment to the internet, where Palo Alto's Unit 42 found it.
Cole Drayden, Dr. Elliott Vance and Marcus Hale work through three stories from one week and argue they are one story:
The autonomous campaign. Unit 42's report on an actor operating as knaithe / KnYuan, running DeepSeek inside the Hermes Agent framework with a terminal, Telegram C2, and custom skills. What ran autonomously (target enumeration via FOFA, vulnerability triage, exploit retrieval, exploitation attempts, pivot decisions) versus what a human did by hand (every single confirmed compromise). The autonomous attempts against Langflow and n8n failed. The manual work exfiltrated data from three Citrix NetScaler targets and executed commands on eleven Marimo instances. Why the failure is the least interesting part.
The volume. August Patch Tuesday, where the CVE count is 415 or 421 depending on whose tally you use, and we say why rather than picking one. CVE-2026-68820, a use-after-free in afd.sys under active exploitation, added to CISA KEV the following day, and the fourth afd.sys zero-day since 2022.
The edge. Cisco CVE-2026-20349 in Secure Firewall ASA and FTD, actively exploited, no workaround. Progress Kemp LoadMaster CVE-2026-8037, CVSS 9.6, 792 exploitation attempts over 41 days, and a three-day federal remediation deadline under BOD 26-04.
Plus four things a security director can start this week, and why obscurity stopped being an accidental control the moment attacker attention stopped being scarce.
Confirmed findings, vendor assessments, and researcher inference are kept distinct throughout.
Six hundred and forty seven thousand and seventeen. That is the number of internet exposed N eight N workflow automation instances that an attacker's software counted on its own before deciding whether any of them were worth attacking. It narrowed that to twenty-five thousand two hundred and nine in one country, sampled about a hundred of those, read the CVE, checked how popular the project was on GitHub, and then wrote in its own session log, and I'm quoting a machine here. The N8N1 with 258 stars and CVSS 10.0 looks extremely promising. That log is public now because the agent running the operation started a web server in its own home directory and served its operator's entire toolkit to the internet. Palo Alto's Unit 42 walked in the open front door and took notes. I am Cole Draden. This is Dark Perimeter with me, as always, Dr. Elliot Vance, who is going to tell us what that report actually establishes and what it does not. And Marcus Hale, who is going to tell us what changes on Monday morning. Which I suspect is less than the headlines suggest and more than we would like. Last week we talked about the 48-hour window about response time collapsing. This week is not about speed. This week is about who is choosing the target.
SPEAKER_01
Let me set the boundaries of the claim first, because this is a story that gets oversold in both directions. Unit 42 published this on July 30th and updated it on August 11th. The actor operates under the handles Nate and Kan Yuan, is assessed to be based in Zhuhai, China, and describes himself publicly as a binary security researcher. He runs an automated vulnerability intelligence pipeline he calls One Day News, which scrapes newly disclosed remote code execution bugs and pushes alerts out over Telegram. That part is not new. Bug feeds have existed for 20 years. What is new is the layer on top. He wired DeepSeek as the reasoning engine into an orchestration framework called Hermes Agent, which gave the model a terminal, a telegram command and control channel, and a set of custom skills. And then he pointed it at the internet. The agent enumerated targets through FOFA, which is essentially a Chinese showdan. It assessed and prioritized vulnerabilities. It downloaded public exploit code on its own initiative. It attempted exploitation. And when a target class did not pan out, it pivoted to a different CVE based on its own read of deployment scale. That is the full loop, and it ran without a human in it.
SPEAKER_00
And the OPSEC failure that gave us all of this?
SPEAKER_01
The agent started a file server in its home directory. Tool configurations, API keys, exploit scripts, session logs, all of it exposed. Unit 42 recovered a single complete Hermes session, dated May 7th. That is the artifact that lets us say any of this with confidence rather than inference. I want to be precise. We are not reasoning from telemetry and guessing at intent. We have the operator's own environment.
SPEAKER_02
Okay, but let me be the person in the room who has to brief a board on this, because there is a number in that report that is doing a lot of work and almost nobody is quoting it. What did the autonomous part actually accomplish?
SPEAKER_01
Nothing.
SPEAKER_02
Say that again, slower.
SPEAKER_01
The autonomous exploitation attempts failed. The agent went after Langflow, CVE 2026-33011, and did not get in because autologin was disabled on the targets. It went after N8N, CVE 2026-21858, and CVE 225-68613, one of which is a CVSS 10.0, and did not get in because authentication was required. Unit 42 says it plainly, the autonomous attempts did not achieve full compromise of any of their intended targets.
SPEAKER_02
And the compromises that did happen?
SPEAKER_01
All manual. Every confirmed impact in that report has a human hand on it. Data exfiltration from three Citrix Netscaler targets via CVE 2026-3055. Command execution confirmed on 11 Marimo Notebook instances via CVE 2026-39987. Java deserialization attempts against nine Apache Tomcat servers, that is CVE 2026-34486, which we will come back to. Reverse shell callbacks against three IKE VPN endpoints. And a sustained multi-day operation against a Malaysian government entity with proxy anonymization added on later attempts, which is a very human thing to do after you realize you were noisy the first time.
SPEAKER_00
So the headline writes itself as AI launches autonomous cyberattack. And the actual finding is AI launched autonomous cyber attack and was bad at it, while its owner did the real damage by hand.
SPEAKER_02
Which is the correct read of the evidence and completely the wrong lesson to walk away with. Cole, I have sat in the meeting where somebody says the AI attacks failed, so we have time. That meeting is how you end up 18 months behind. Read the sentence, Unit 42 actually wrote at the end because they were careful with it.
SPEAKER_01
While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability.
SPEAKER_02
That part now runs unattended. The exploitation failed because those specific targets were configured correctly. Configuration drift is a fact of the universe. The targeting worked.
SPEAKER_00
Elliot. There is a detail in the toolkit inventory I want you to unpack because I think it says something about where this is going. He was not just running DeepSeq.
SPEAKER_01
He was evaluating a market. Alongside the Hermes and DeepSeq stack, which did the autonomous work, the environment showed limited usage of Claude Code running Opus through a proxy, Codex running GPT-5.4 through a proxy, and several Chinese market models, Quencode, GLM, Kimi, Minimax. The Western tools were routed through a proxy service to reduce traceability, and anti-attribution settings were configured across all of them. Unit 42 is explicit that they cannot verify actual usage of the Codex path because the operator configured the system to limit local response storage. They flagged the correlation between trusted directories and successful campaigns as notable. Notable is doing honest work there. It is an assessment, not a finding.
SPEAKER_00
And the provider side?
SPEAKER_01
So the guardrails engaged. And the operator's response to guardrails engaging was to keep a domestic model in the driver's seat and treat the Western frontier models as optional accessories.
SPEAKER_02
Which is the part I would put in the board deck. Not AI is attacking us. The line is refusal at the Frontier Lab does not remove the capability. Your threat model cannot depend on somebody else's terms of service.
SPEAKER_00
Let us put this against the volume story, because they collide this week in a way I do not think is coincidental. Tuesday was Patch Tuesday.
SPEAKER_01
And the number depends on who you ask, which I want to name, rather than paper over. CrowdStrike's analysis counts 415 vulnerabilities. Security Week counts 421. The gap is accounting, mostly around how republished and extended security update CVEs get tallied. And neither outlet is wrong so much as they are counting different things. If you want a defensible number to put in a slide, say roughly 420, and cite which count you used. For scale, July was 622. August is a decrease.
SPEAKER_02
August is a decrease. Sit with that.
SPEAKER_01
One vulnerability under active exploitation, CVE 2026-68820, a use after free in AFD.swise, the ancillary function driver for WinSock, CVSS 7.0, local privilege escalation, low-privileged attacker to system, no user interaction, triggered by winning a race condition with a crafted application. Microsoft confirmed exploitation in the wild, and CISA added it to the known exploited vulnerabilities catalog on August 12th, the day after. 62 criticals in the set, three publicly disclosed. Elevation of privilege is 42% of the batch. Remote code execution 26%. Fourth time since 2022, Satnam Narang at Tenable made that point and raised the nation-state question, noting one of the prior AFD.as' zero days was linked to North Korea's Lazarus group. I want to flag the epistemic status carefully. That is a researcher's inference from a pattern, not an attribution from an agency or a filing. It is a reasonable inference. It is not established.
SPEAKER_02
Here is what I actually care about with that CVE, and it is not the attribution. It is a local privilege escalation. Every threat model I review still has a soft assumption buried in it that says local means less urgent because the attacker has to already be on the box. Fine. But go look at what we just spent 15 minutes talking about. The initial access half of the kill chain is the half being automated first, because it is the half that is mass parallel and cheap to retry. If the front door is getting cheaper at scale, then the attacker has to already be on the box, is not the discount it used to be. Local privilege escalation is the second stage of an attack whose first stage is getting industrialized.
SPEAKER_00
Which brings us to the edge and the third thread this week. Marcus, the things that actually got exploited in the wild in the last seven days were not exotic.
SPEAKER_02
They were load balancers and firewalls, which is where they always are. To that matter, Cisco, CVE 2026, 2349, CVSS 8.6, secure firewall ASA and threat defense, insufficient error checking while processing HTTP requests to the remote access SSL VPN service. An unauthenticated attacker sends malformed traffic. The device reloads. You have a denial of service on the box that terminates your remote access. ASA branches 9116, 918, 920, 922, 923, and 924. FTD 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Management Center is not affected. There are no workarounds. You upgrade or you stay exposed. Cisco confirmed active exploitation. And to their credit, they founded an internal testing and also received an independent report from a researcher named Valerio Brussani. So this was not discovered by watching customers burn. Second, Progress Kemp Loadmaster, CBE 2026-8037, CBSS 9.6, command injection through improper input handling in an escape quotes function, unauthenticated arbitrary command execution on the appliance across multiple endpoints. Eastentire counted 792 exploitation attempts over 41 days from 65 unique IPs in 18 countries. Last activity, August 4th, and characterized the attempts as largely unsuccessful. CESA added it on August 7th, with a federal deadline of August 10th under Binding Operational Directive, 26 door 4, 3 days.
SPEAKER_00
Three days on a device that by definition sits in front of everything.
SPEAKER_02
And you cannot take it down during business hours, which is the entire problem in one sentence.
SPEAKER_01
There is a thread connecting all of this that I think is the actual episode. Look at the Tomcat CVE 2026-34486. It is a CVSS 7.5. Missing encryption of sensitive data bypasses the encrypt interceptor cluster component. Fixed back in April in 11.021, 10.1.54, and 9.0.117. CISA added it to Kev on July 27th with an August 7th federal deadline. And it appears in the Unit 42 report as one of the CVEs this actor exploited by hand against nine servers. Same with Langflow, CVE 20269198, CVSS 9.8, unauthenticated code injection giving superuser access on default deployments. Versions 1.0.0 through 1.10.0, fixed in 1.10.1 in July. 650 exploitation attempts from 244 unique IPs across 41 countries starting July 6th.
SPEAKER_00
So the same small set of bugs shows up in the agent's target list in the Humans Manual campaign. In CISA's catalog, and in mass scanning telemetry.
SPEAKER_01
Within weeks, that convergence is the finding. The bottleneck in offensive operations was never exploit development for this class of adversary. It was attention, deciding which of 420 new CVEs on top of the standing backlog is worth an afternoon. That decision is now being made by software cheaply at a scale no human triage team matches, and it is converging on the same answers.
SPEAKER_02
And on our side of the table, that decision is still a spreadsheet and a meeting. That is the asymmetry, not intelligence, not sophistication, throughput on the prioritization step.
SPEAKER_00
So what do you actually do? Give me things a director can start this week, not a transformation program.
SPEAKER_02
Four, and none of them are new, which is rather the point. One, stop treating internet-facing appliance patching as change managed infrastructure work and start treating it as incident response. Loadmaster gave federal agencies three days. If your process cannot move an edge device inside a week, your process is the vulnerability. Preauthorize the maintenance window now before you need it. Two, inventory the AI and automation middleware. Langflow, N8N, Marimo, the agent frameworks your data science team installed on a Tuesday. These are the platforms showing up in this actor's target list, and they got installed outside your normal software intake because they look like developer tooling rather than production infrastructure. Somebody at your company has an N8N instance on a public IP right now, and it is not in your CMDB. 3. The two failures that saved targets in the Unit 42 campaign were autolog and disabled and authentication required. Default deny on new tooling. That is the whole control. It is unglamorous and it beat an autonomous agent twice. 4. Assume mass, indiscriminate, well-informed target selection is now the baseline, including against organizations that previously reasoned they were too small or too boring. The agent in this report attacked Chinese domestic infrastructure indiscriminately in its own country because it had no concept of a target profile. Obscurity was never a control. It is now not even an accident that occasionally helps.
SPEAKER_01
I would add a fifth, which is epistemic. When the next report lands, and it will, read what it establishes rather than what it suggests. This one is unusually well evidenced because of an operator mistake, and it still separates confirm compromise from assessed usage. Most of what follows will not be that careful, and the temptation on both sides, vendors selling AI defense and skeptics dismissing AI offense, will be to flatten it.
SPEAKER_00
Here is where I land. The story everyone will tell about this week is that an AI ran an attack campaign. That is not quite true, and the parts that are true are the least alarming parts. It tried and it failed, and a human had to do the actual work. But the story underneath is the one that should keep you up. The economics of picking a victim changed. For as long as any of us have been doing this, being unremarkable was a real defense, not because anyone designed it that way, but because attention was scarce and attackers had to spend it somewhere. Six hundred and forty-seven thousand instances counted, a hundred sampled, a C VSS score, and a GitHub star count weighed against each other by a machine that does not get bored and does not go home. Attention is not scarce anymore. Whatever protection you were getting from being one of many, you are not getting it now. Patch the load balancer. This is dark perimeter.
