BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for AI-assisted intrusions against Indian universities

Linha do tempo

1. gbhackers.com ↗ · pub. 23/10/2026 02:16 · coletado 23/10 03:00

   BUGSTER Uses DeepSeek V4 and Hermes Agent for AI-Assisted Intrusions, Stealing 5,200+ Records from Indian University

   ler a análise desta fonte ocultar

   Unit 42 reports that a threat actor using the handle BUGSTER set up DeepSeek V4 as the reasoning engine of an AI-assisted cybercrime operation against organizations in India, including universities. AI-generated reconnaissance and scripts were used to brute-force a university website. In a separate intrusion, the actor exfiltrated a MongoDB database with more than 5,200 student and faculty records containing PII. The activity shows how AI tooling can raise the capability of a relatively inexperienced operator across credential theft, data theft, wireless attacks, cryptocurrency research and fraud planning. Unit 42 links the case only thematically to its July 2026 report on another actor using Hermes Agent and DeepSeek; the campaigns are distinct.

   Technical Details

   • BUGSTER ran the Hermes Agent framework with DeepSeek V4, used Cursor as an additional AI coding tool, and controlled specialized Hermes profiles via Telegram ("alice" for VoIP fraud advice, "pandarouter" for carrier and call-routing research). The actor also tested other AI models and used prompt-level overrides to reduce safety restrictions.
   • University attack: AI-generated reports mapped 12 subdomains (LMS, student portal, administration dashboard). WordPress REST API data exposed 13 user accounts. A generated password-guessing tool (117 usernames, 28 common passwords) yielded a valid login.
   • Separate intrusion: an administrator account with a weak password gave access to a MongoDB database, which was exfiltrated (5,200+ records).
   • Other tooling found: credential-scanning tools for exposed secrets (cloud and private keys), cryptocurrency-holder reconnaissance scripts, and a C2 listener supporting reverse shells.
   • Wi-Fi cracking pipeline: a nearby Linux device captured authentication material and sent it to cloud GPU instances for cracking, suggesting physical proximity to targets (locations not identified).
   • VoIP fraud: the AI chats covered business identity setup, carrier access, call routing and caller-ID evasion, including a "NEXT EXPLOIT OPPORTUNITIES" section. Unit 42 found no call logs, SIP traces or active routing, so this indicates planning or early setup, not confirmed fraud or successful STIR/SHAKEN evasion.

   Remediation

   The article gives no explicit remediation. The intrusions relied on weak and guessable credentials and exposed WordPress REST API user data, so strong unique passwords, MFA for admin accounts, limiting user enumeration and securing MongoDB administrator access are relevant.

2. unit42.paloaltonetworks.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 12:00 primeiro registro

   BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for credential theft, VoIP fraud planning and Wi-Fi cracking, hitting Indian universities

   ler a análise desta fonte ocultar

   Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reconnaissance reports, the actor attacked targets mainly in India. They ran a brute-force campaign against one university's online education platform and exfiltrated a MongoDB database with more than 5,200 records, including student PII, from a second university. They also planned a fraudulent VoIP operation, ran Wi-Fi cracking pipelines and profiled cryptocurrency whales. Unit 42 notes that unrelated actors are adopting the same Hermes + DeepSeek toolchain, which suggests a growing trend of AI lowering the skill barrier for cybercrime.

   Technical Details

   • Attack chain against the Indian university platform: subdomain enumeration (12 subdomains including WordPress, an LMS, a student portal and an admin dashboard); WordPress REST API enumeration that extracted 13 user IDs and bypassed the Cloudflare WAF block on direct user endpoints; a generated brute-force tool with 117 usernames and 28 common passwords; one WordPress login flagged as valid.
   • Second university: a MongoDB database was exfiltrated using an administrator account with a weak password. It held student (diploma, undergraduate, postgraduate) and faculty records, and the manifest also recorded exposed cloud load balancing, edge routing, database services and a third-party cloud storage service account.
   • E-commerce site: an Indian site on a popular e-commerce platform was enumerated and three admin email addresses were extracted. The LLM-generated attack report included a "NEXT EXPLOIT OPPORTUNITIES" section outlining planned follow-up attacks.
   • VoIP fraud planning: the "alice" Hermes profile (DeepSeek V4) advised on registering a US LLC and EIN, obtaining SIP trunks, mixing about 70% legitimate with 30% fraudulent traffic to stay under carrier audit thresholds, bypassing STIR/SHAKEN, CLI spoofing, and monetizing via toll fraud and least-cost routing. The "pandarouter" profile researched carriers. No call logs, SIP traces or active routing were found, so the operation appears to have been in early setup.
   • C2 and payloads: a Python-based C2 listener for Windows reverse shells, a Base64-encoded PowerShell reverse shell delivered via VBScript, a QubesOS VM setup script with SSH and ncat, and multiple Windows shell variants.
   • Wi-Fi cracking: a Kali device ("Pi") placed near target networks captured WPA PMKID/EAPOL handshakes. They were sent over an SSH tunnel to Vast.ai GPU instances for cracking, with results returned via Discord webhooks. This requires physical proximity, indicating local access.
   • Credential scanning and crypto reconnaissance: a Go-based toolkit scraped webpages for exposed Google Cloud service account keys, CDN API keys and private keys in logs. The actor also scraped the top 500 ETH holders via the DeBank API and documented 45 whales, likely for future targeting, with no follow-on activity seen.
   • Infrastructure and AI tooling: a single US-based server (162.243.3[.]92) hosted Hermes Agent, a Cursor proxy (cipher-proxy.sh) and supporting components. Hermes was controlled via Telegram bots with three profiles plus four additional profiles (dev, check, vuln, deploy). The actor tested GLM 5.2 and other models through OpenRouter, tried prompt-level overrides to defeat safety controls, and settled on DeepSeek V4.

   Remediation

   • Enforce strong, unique admin passwords with MFA and rate-limit or lock out repeated login attempts on WordPress and database administration.
   • Restrict WordPress REST API user enumeration (author fields and sitemaps) and do not rely on the WAF alone.
   • Avoid exposing databases such as MongoDB, and keep API keys, service account keys and private keys out of public pages and logs.
   • Block or monitor the listed infrastructure and audit Wi-Fi networks (WPA) for rogue capture devices.
   • Telecom providers should strengthen carrier compliance and traffic auditing against mixed legitimate/fraudulent traffic.