Executive Summary

“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities.

Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types.

Unit 42’s investigation into the actor’s operational environment and activities makes two things clear:

• The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools.
• Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities. The actor recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces.

The attacker’s conversations with jailbroken AI tools included getting step by step advice on how to set up a fraudulent Voice over IP (VoIP) operation. One assistant “helpfully” generated a document including a “NEXT EXPLOIT OPPORTUNITIES” section, outlining planned followup attacks.

Unit 42 identified and investigated this threat actor's operational environment. There, we determined that they had weaponized an AI assistant across several types of cybercrime, including:

• Credential theft and data exfiltration
• VoIP telecommunications fraud
• Wi-Fi password cracking
• Cryptocurrency reconnaissance
• Command-and-control (C2) operations

An actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safety controls disabled. The actor ran an AI-generated brute-force campaign against an Indian university’s website. The actor also achieved a confirmed intrusion against a second university, where they exfiltrated a database of more than 5,200 records, including personally identifiable information (PII) on students.

The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders). Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations.

Multiple, unrelated actors are independently adopting the same Hermes + DeepSeek combination. This suggests we may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities. We assess a key driver is low safety friction at low cost: DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

• Advanced URL Filtering and Advanced IP Defense
• Cortex XDR and XSIAM
• Cortex Agentic Endpoint Security
• Cortex Cloud
• Idira Privileged Access Manager (PAM)
• Idira Identity and Access Manager (IAM)
• Idira Secrets Manager

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Technical Analysis

We identified evidence that the threat actor leveraged AI systems for a wide range of criminal activity against multiple target networks, primarily in India. The criminal activity included:

• Planning for VoIP fraud
• Credential theft targeting several organizations
• Wi-Fi password cracking
• Cryptocurrency reconnaissance
• C2 payloads

Credential Theft and Data Exfiltration

WordPress Brute Force

The actor used AI-generated reconnaissance to conduct a methodical attack against an Indian university's online education platform. The actor’s enumeration reports exhibit structured formatting (executive summaries, severity ratings, systematic endpoint categorization) consistent with AI-generated output. The attack progressed through four stages:

1. Subdomain enumeration: The actor identified 12 subdomains including the main WordPress site, a learning management system (LMS), student portal and administration dashboard
2. WordPress REST API enumeration: The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall (WAF) that blocked direct user endpoint access
3. Targeted brute force: A generator script produced a brute force tool with 117 usernames (derived from the enumeration) and 28 common passwords
4. Credential brute force: The actor’s tool flagged one WordPress login as valid

Figure 1 shows an excerpt from the actor's WordPress REST API enumeration report (stage 2).

Figure 2 shows output from a brute force attempt that recorded a candidate credential (stage 4).

University Database Exfiltration

The actor exfiltrated a MongoDB database from a second Indian public university. The exfiltration tooling wrote a manifest alongside the dumped collections, recording the following data:

• Admin credential obtained: An administrator account with a weak password
• Exfiltrated records: Thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII
• Infrastructure exposed: Cloud load balancing, edge routing, database services, and a third-party cloud storage service account

E-Commerce Enumeration

The actor enumerated an Indian site on a popular e-commerce platform, extracting:

• A storefront API token
• Three admin email addresses
• Two phone numbers
• Payment merchant IDs

The attack report is a suspected large language model (LLM)-generated document, including a NEXT EXPLOIT OPPORTUNITIES section outlining planned follow-up attacks.

VoIP Telecommunications Fraud

We also identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using the alice Hermes profile as an AI-powered advisor. Evidence included:

• Advisory conversations
• A detailed technical knowledge base
• Carrier research

However, the absence of call logs, Session Initiation Protocol (SIP) traces or active call routing suggested the operation was still in a planning or early setup phase.

With DeepSeek V4 as the underlying model, alice provided detailed, actionable criminal methodology through conversations and a comprehensive fraud knowledge base ingested into the bot. The actor developed a planned approach following an established VoIP fraud model:

• Establish a legitimate front: Register a US limited liability company (LLC) with an employer identification number (EIN) to qualify as a telecommunications provider. The knowledge base includes detailed guidance on:
  • Forming LLCs in Wyoming or Delaware as a non-US resident
  • Obtaining an EIN without a Social Security number via the US Internal Revenue Service (IRS) fax
  • Completing Federal Communications Commission (FCC) registration
• Obtain carrier access: Contract with legitimate VoIP carriers to purchase call routing capacity (SIP trunks).
• Traffic mixing: Route approximately 70% legitimate call traffic alongside 30% fraudulent calls to stay below carrier compliance audit thresholds.
• Bypass caller ID authentication: Circumvent STIR/SHAKEN, the FCC-mandated caller identity verification framework. In the advisory conversations, alice covers bypass techniques and Calling Line Identification (CLI) spoofing.
• Monetize: Generate revenue with the 30% fraudulent traffic through toll fraud and other non-compliant routes. Least-cost routing (LCR) optimizes per-minute costs across carrier tiers.

Figure 3 shows an excerpt from an alice conversation including the actor asking and DeepSeek advising on fraud traffic ratios and carrier evasion.

The pandarouter profile handled carrier research. The excerpt below in Figure 4 illustrates how the actor used it to investigate a wholesale VoIP carrier for regulatory vulnerabilities and past fraud.

Other Operations

Command and Control

The threat actor’s infrastructure maintained a listening port for a Python-based C2 listener supporting Windows reverse shell connections. Supporting payloads include:

• A Base64-encoded PowerShell reverse shell delivered via VBScript
• A QubesOS VM setup script with SSH and ncat
• Multiple Windows shell variants

Wi-Fi Password Cracking

The actor developed an automated Wi-Fi password cracking process. A Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points.

The server collected these hashes over an SSH tunnel and dispatched them to Vast.ai cloud GPU instances for cracking, with results automatically reported back to the actor via Discord webhooks. This technique requires physical proximity to the target networks, indicating the actor had local access to the targeted locations.

Credential Scanning Toolkit

We also identified a large Go-based credential-scanning toolkit. This toolkit scrapes webpages and extracts exposed credentials, including:

• .env values
• S3 signed URLs
• Google Cloud service account keys
• Content delivery network (CDN) API keys
• Private keys in log files

A companion Python script scrapes domain lists for scanning.

Cryptocurrency Reconnaissance

The actor scraped the top 500 ETH holders and major token holders via the DeBank API, producing intelligence files that documented 45 cryptocurrency whales with net worth figures. We assess this was likely for future targeting, but we were unable to identify any follow-on activity during this research.

Tool Design and Infrastructure

The threat actor used a single US-based server (162.243.3[.]92) to host multiple core services, including:

• The Hermes Agent framework
• A C2 listener
• A Cursor integrated development environment (IDE) proxy
• Several supporting components

Our analysis of the actor’s logs and test scripts indicates that they experimented with various LLMs, including GLM 5.2 by Zhipu AI and other models accessed through OpenRouter. Ultimately, they chose DeepSeek V4 as the backend for operations.

The actor's test scripts show repeated attempts to defeat model safety controls with a prompt-level override. Although GLM 5.2 is an open-weight model that has been reported as weakly guarded, the actor built a dedicated script to send the override to GLM 5.2 and flag refusals. This is evidence of resistance the actor worked to overcome.

The actor ultimately operationalized DeepSeek V4, consistent with the minimal safety controls observed in the Chinese-speaking activity we previously reported. Figure 5 shows an example of the system prompt the actor used to override model safety controls (from the actor's model-testing scripts, e.g., test_batch1.py).

Table 1 summarizes the actor's AI tool configurations.

Table 1. AI tool configurations.

Figure 6 shows a flowchart that illustrates the actor's infrastructure and how the AI tools interconnect.

The Hermes Agent served as the actor's primary interface, controlled via Telegram direct messages. The actor maintained three Hermes profiles as specialized AI modes, each running as a separate Telegram bot gateway spawned from the operator's session (Table 2).

Table 2. Telegram Hermes profiles.

The actor configured four additional profiles (dev, check, vuln, deploy) in a shared Telegram group. While we did not observe any chat artifacts for these profiles, the naming suggests the actor used AI to assist with development, validation, vulnerability testing and deployment automation functions.

The Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls. The configuration and the AI-generated scripts on the host shown below in Figure 7 suggest the actor used it for code development.

Attribution

We assess the actor is a financially motivated, multi-domain criminal operator with no prior reporting. The actor is English-speaking with informal, frequently broken grammar. The alice bot's stored memory describes the actor as a “gamer, OSINT, VoIP entrepreneur” claiming to hold a US LLC and EIN. Figure 8 below shows text from the pandarouter bot's stored memory, which is more candid.

Table 3 lists further attribution indicators of this actor.

Table 3. Attribution indicators.

Conclusion

This case illustrates how AI lowers the skill barrier for cybercrime. The actor used basic tooling and relied on AI-generated scripts and reconnaissance reports, but still achieved notable impact. They recovered more than 5,200 PII records and mapped multiple organizations' attack surfaces. AI enabled a single actor to operate across diverse attack types (credential theft, VoIP fraud, Wi-Fi cracking, cryptocurrency targeting) that would traditionally require distinct skill sets.

The VoIP fraud planning demonstrates a particularly notable use of AI as a domain expert. With DeepSeek V4 as the underlying model, the actor's bot profiles provided detailed, actionable criminal guidance.

This guidance included specific fraud-to-clean traffic ratios, carrier audit thresholds to stay below and operational security measures to avoid detection. The model's minimal safety controls allowed it to function as an on-demand criminal advisor, enabling the actor to acquire operational expertise through conversation rather than experience.

Combining these findings with our previous reporting on a Chinese-Speaking threat actor leveraging the Hermes + DeepSeek toolchain points to growing uptake of this combination among cybercriminals.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

• Advanced URL Filtering and Advanced IP Defense identify known domains and URLs associated with this activity as malicious.
• Cortex XDR and XSIAM are designed to accurately detect the threats described in this article with the Malware Prevention Engine, and behavioral analytics to reveal the root cause to speed up investigations.
• Cortex Agentic Endpoint Security is designed to help discover every AI artifact and AI agents activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations.
• Cortex Cloud is designed to protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute and serverless agents, Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to disguise their presence, alter configurations or execute anomalous operations in the environment.
• Idira Privileged Access Manager (PAM) is designed to unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets.
• Idira Identity and Access Manager (IAM) is designed to enable secure, unified access across human, machine, and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login, and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce to meet the security demands of today and tomorrow.
• Idira Secrets Manager is designed to help secure and automate API keys and webhook tokens just-in-time to eliminate hardcoded credentials and prevent exfiltration.

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

• 162.243.3[.]92 - actor infrastructure
• 104.238.38[.]202 - commercial proxy server

Additional Resources

• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks – Palo Alto Networks Unit 42