BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for credential theft, VoIP fraud planning and Wi-Fi cracking, hitting Indian universities
Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reconnaissance reports, the actor attacked targets mainly in India. They ran a brute-force campaign against one university's online education platform and exfiltrated a MongoDB database with more than 5,200 records, including student PII, from a second university. They also planned a fraudulent VoIP operation, ran Wi-Fi cracking pipelines and profiled cryptocurrency whales. Unit 42 notes that unrelated actors are adopting the same Hermes + DeepSeek toolchain, which suggests a growing trend of AI lowering the skill barrier for cybercrime.
Detalhes técnicos
- Attack chain against the Indian university platform: subdomain enumeration (12 subdomains including WordPress, an LMS, a student portal and an admin dashboard); WordPress REST API enumeration that extracted 13 user IDs and bypassed the Cloudflare WAF block on direct user endpoints; a generated brute-force tool with 117 usernames and 28 common passwords; one WordPress login flagged as valid.
- Second university: a MongoDB database was exfiltrated using an administrator account with a weak password. It held student (diploma, undergraduate, postgraduate) and faculty records, and the manifest also recorded exposed cloud load balancing, edge routing, database services and a third-party cloud storage service account.
- E-commerce site: an Indian site on a popular e-commerce platform was enumerated and three admin email addresses were extracted. The LLM-generated attack report included a "NEXT EXPLOIT OPPORTUNITIES" section outlining planned follow-up attacks.
- VoIP fraud planning: the "alice" Hermes profile (DeepSeek V4) advised on registering a US LLC and EIN, obtaining SIP trunks, mixing about 70% legitimate with 30% fraudulent traffic to stay under carrier audit thresholds, bypassing STIR/SHAKEN, CLI spoofing, and monetizing via toll fraud and least-cost routing. The "pandarouter" profile researched carriers. No call logs, SIP traces or active routing were found, so the operation appears to have been in early setup.
- C2 and payloads: a Python-based C2 listener for Windows reverse shells, a Base64-encoded PowerShell reverse shell delivered via VBScript, a QubesOS VM setup script with SSH and ncat, and multiple Windows shell variants.
- Wi-Fi cracking: a Kali device ("Pi") placed near target networks captured WPA PMKID/EAPOL handshakes. They were sent over an SSH tunnel to Vast.ai GPU instances for cracking, with results returned via Discord webhooks. This requires physical proximity, indicating local access.
- Credential scanning and crypto reconnaissance: a Go-based toolkit scraped webpages for exposed Google Cloud service account keys, CDN API keys and private keys in logs. The actor also scraped the top 500 ETH holders via the DeBank API and documented 45 whales, likely for future targeting, with no follow-on activity seen.
- Infrastructure and AI tooling: a single US-based server (162.243.3[.]92) hosted Hermes Agent, a Cursor proxy (cipher-proxy.sh) and supporting components. Hermes was controlled via Telegram bots with three profiles plus four additional profiles (dev, check, vuln, deploy). The actor tested GLM 5.2 and other models through OpenRouter, tried prompt-level overrides to defeat safety controls, and settled on DeepSeek V4.
Remediação
- Enforce strong, unique admin passwords with MFA and rate-limit or lock out repeated login attempts on WordPress and database administration.
- Restrict WordPress REST API user enumeration (author fields and sitemaps) and do not rely on the WAF alone.
- Avoid exposing databases such as MongoDB, and keep API keys, service account keys and private keys out of public pages and logs.
- Block or monitor the listed infrastructure and audit Wi-Fi networks (WPA) for rogue capture devices.
- Telecom providers should strengthen carrier compliance and traffic auditing against mixed legitimate/fraudulent traffic.
Linha do tempo
-
BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for credential theft, VoIP fraud planning and Wi-Fi cracking, hitting Indian universities
ler a análise desta fonte ocultar
Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reconnaissance reports, the actor attacked targets mainly in India. They ran a brute-force campaign against one university's online education platform and exfiltrated a MongoDB database with more than 5,200 records, including student PII, from a second university. They also planned a fraudulent VoIP operation, ran Wi-Fi cracking pipelines and profiled cryptocurrency whales. Unit 42 notes that unrelated actors are adopting the same Hermes + DeepSeek toolchain, which suggests a growing trend of AI lowering the skill barrier for cybercrime.
Technical Details
- Attack chain against the Indian university platform: subdomain enumeration (12 subdomains including WordPress, an LMS, a student portal and an admin dashboard); WordPress REST API enumeration that extracted 13 user IDs and bypassed the Cloudflare WAF block on direct user endpoints; a generated brute-force tool with 117 usernames and 28 common passwords; one WordPress login flagged as valid.
- Second university: a MongoDB database was exfiltrated using an administrator account with a weak password. It held student (diploma, undergraduate, postgraduate) and faculty records, and the manifest also recorded exposed cloud load balancing, edge routing, database services and a third-party cloud storage service account.
- E-commerce site: an Indian site on a popular e-commerce platform was enumerated and three admin email addresses were extracted. The LLM-generated attack report included a "NEXT EXPLOIT OPPORTUNITIES" section outlining planned follow-up attacks.
- VoIP fraud planning: the "alice" Hermes profile (DeepSeek V4) advised on registering a US LLC and EIN, obtaining SIP trunks, mixing about 70% legitimate with 30% fraudulent traffic to stay under carrier audit thresholds, bypassing STIR/SHAKEN, CLI spoofing, and monetizing via toll fraud and least-cost routing. The "pandarouter" profile researched carriers. No call logs, SIP traces or active routing were found, so the operation appears to have been in early setup.
- C2 and payloads: a Python-based C2 listener for Windows reverse shells, a Base64-encoded PowerShell reverse shell delivered via VBScript, a QubesOS VM setup script with SSH and ncat, and multiple Windows shell variants.
- Wi-Fi cracking: a Kali device ("Pi") placed near target networks captured WPA PMKID/EAPOL handshakes. They were sent over an SSH tunnel to Vast.ai GPU instances for cracking, with results returned via Discord webhooks. This requires physical proximity, indicating local access.
- Credential scanning and crypto reconnaissance: a Go-based toolkit scraped webpages for exposed Google Cloud service account keys, CDN API keys and private keys in logs. The actor also scraped the top 500 ETH holders via the DeBank API and documented 45 whales, likely for future targeting, with no follow-on activity seen.
- Infrastructure and AI tooling: a single US-based server (162.243.3[.]92) hosted Hermes Agent, a Cursor proxy (cipher-proxy.sh) and supporting components. Hermes was controlled via Telegram bots with three profiles plus four additional profiles (dev, check, vuln, deploy). The actor tested GLM 5.2 and other models through OpenRouter, tried prompt-level overrides to defeat safety controls, and settled on DeepSeek V4.
Remediation
- Enforce strong, unique admin passwords with MFA and rate-limit or lock out repeated login attempts on WordPress and database administration.
- Restrict WordPress REST API user enumeration (author fields and sitemaps) and do not rely on the WAF alone.
- Avoid exposing databases such as MongoDB, and keep API keys, service account keys and private keys out of public pages and logs.
- Block or monitor the listed infrastructure and audit Wi-Fi networks (WPA) for rogue capture devices.
- Telecom providers should strengthen carrier compliance and traffic auditing against mixed legitimate/fraudulent traffic.