RESEARCHERS at Jesta Security intercepted a sophisticated cyberattack involving a DeepSeek AI agent, allegedly weaponized by a Chinese threat actor, targeting over 1,200 hosts for proxyjacking. The investigation revealed that the campaign operated autonomously over five days, characterized by quick reconnaissance and short SSH sessions aiming to build infrastructure for future attacks rather than immediate theft or modification.
Jesta noted the attacker displayed behaviors typical of AI models, such as rapid execution of commands and generated output structured for AI interpretation. This highlights a trend toward increasing autonomous AI-driven cyberattacks, stressing the need for improved defensive strategies like deception techniques and engagement with the attacker to gather crucial intelligence.