Zhuhai Threat Actor Used DeepSeek and Telegram to Launch 460 Cyberattacks

·1 views

A China-based threat actor linked to Zhuhai integrated the DeepSeek AI model with an open-source agent framework called Hermes and operated the entire attack chain through Telegram. Palo Alto Networks' Unit 42 published its analysis on August 2, detailing how the actor used this setup to compromise over 460 internet-facing systems across multiple victims. DeepSeek handled target enumeration and exploit sourcing, while Telegram served as a real-time control interface, eliminating the need for traditional command-line interaction. Unit 42 connected the campaign to a known group with a history of targeting manufacturing and software firms in the Asia-Pacific region. The incident highlights how readily available AI models, open-source frameworks, and free messaging platforms can now be combined to build functional, large-scale attack automation with minimal technical barriers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PromptOT Adds MCP Server to Let AI Coding Tools Manage Production Prompts

PromptOT, a prompt management platform for production LLM applications, has integrated a Model Context Protocol (MCP) server to allow AI coding assistants like Claude, Cursor, and Codex to interact directly with prompt workspaces. Previously, developers had to leave their AI tools and manually update prompts through a separate dashboard, creating a disruptive context switch. The new MCP server exposes 23 structured tools across five areas, enabling assistants to list, create, update, version, and publish prompts without unrestricted database access. Using the standardized MCP protocol means PromptOT needs only one integration instead of separate custom builds for each AI client. The update allows teams to manage prompt blocks, runtime variables, versioning, and rollbacks entirely from within their preferred AI-assisted development environment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Is Forcing Developers to Rethink the Culture of Building in Public

For years, developers built credibility by openly sharing code, blog posts, and ideas — but the rise of AI is disrupting that culture. Detailed technical content published online can now be fed into large language models and rapidly turned into working prototypes, pitch decks, or monetizable products, eroding the link between an original idea and its creator. Attribution has become harder to trace as AI-generated implementations obscure the lineage of shared concepts. In response, many developers are shifting toward sharing the 'why' behind their work rather than the 'how,' and gravitating toward private, trust-based communities instead of open forums. While the open-source social contract of the 2010s may be fading, developers argue their edge lies in taste, lived experience, and the judgment to decide what is worth building — qualities AI cannot replicate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CSP via Meta Tag: How It Works, Its Limits, and When to Use It

Developers can define a Content Security Policy directly in HTML using a meta tag instead of HTTP response headers, which is useful for static sites, prototypes, and platforms like GitHub Pages that do not allow custom headers. However, the meta tag approach has notable limitations: the browser only enforces the policy after parsing the tag, meaning resources loaded earlier may bypass it. Several directives — including report-uri, report-to, frame-ancestors, and sandbox — are ignored when set via a meta tag, eliminating violation reporting and clickjacking protection. HTTP response headers are processed before any page content renders, making them the stronger and preferred option for production environments. Best practice recommends reserving the meta tag method for development or constrained environments, and always placing it as early as possible within the document head.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Replacing a Metrics God Class with Per-Subsystem Modules Improved an OTel Codebase

A software team refactored their OpenTelemetry metrics architecture by replacing a single monolithic god class with separate per-subsystem modules, each owning its own instruments. The original design used multiple inheritance mixins on one global Metrics object, which caused silent attribute shadowing and forced developers to call methods through explicit base classes to avoid name collisions. OpenTelemetry's core constraint — that instruments can be created only once per process and never unregistered — means every codebase must carefully manage a process-level singleton. The new pattern solves this with a frozen dataclass holding OTel handles, a memoized factory function acting as the singleton, and a lightweight wrapper class instantiated per request. This approach enforces composition over inheritance, keeping metric definitions close to the code that uses them and eliminating the risk of silently lost metrics.

0 comments Read more at DEV Community