An attacker deployed an AI agent in fully autonomous mode to conduct post-exploitation activities against Thailand’s Ministry of Finance, which operates the country’s treasury and tax collection systems. The operator installed Hermes, an open-source AI assistant from Nous Research, on a rented server and disabled the permission-checking safeguard that normally requires approval before executing risky commands.
Threat intelligence firm Hunt.io and researcher Bob Diachenko discovered the operation after finding exposed logs on a web server with directory listing enabled. The server contained 585 files and 470 MB of attack tooling, along with the agent’s own operational logs documenting its autonomous activities inside the ministry’s network.
How Did the Autonomous AI Agent Operate?
The attacker activated Hermes using YOLO mode, a documented feature that allows the agent to execute commands without requesting human approval for each action. This mode can be enabled three ways: a –yolo flag at launch, a /yolo command during a session, or a HERMES_YOLO_MODE=1 environment variable. The project’s configuration guide explicitly states this setting should “only use this in trusted, sandboxed environments.”
Five files named call_00_*.txt contained the agent’s operational turns, showing it conducted kernel vulnerability scanning, ran LinPEAS privilege escalation scripts twice, swept for elevated-permission binaries, created filesystem listings, and executed a recursive crawl of the web root belonging to the Office of the Permanent Secretary. That directory contained Office documents, performance evaluations, and personnel records dating to 2012.
What Attack Infrastructure Was Discovered?
The recovered materials included a hidden web shell planted on a ministry web server, scripts targeting named internal Hadoop systems, and stolen mailbox passwords hardcoded into mail-testing scripts. A customized linpeas.sh script checked for four 2026 Linux kernel vulnerabilities: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503).
Most custom code targeted the ministry’s Hadoop cluster. A script called hive_rce_py2.py connected to HiveServer2 on an internal machine at port 10000, exploiting the default NONE authentication mode that accepts any password without verification. Once connected, the script installed a malicious Java add-on called HiveCmd.jar as a user-defined function, enabling operating-system command execution through ordinary database queries.
What Attribution Indicators Were Found?
The operator’s SSH session originated from 103.97.0[.]57 in Hong Kong. The agent’s web interface password contained the Chinese word Leishen, meaning thunder god, and a key for FOFA, a Chinese asset-search service, was found alongside it. The same server previously hosted a ShadowPad controller and currently runs a VShell command-and-control listener.
Hunt.io also discovered a previously undocumented Go implant the operator named Hades, built for both Windows and Linux in 62 copies. The firm analyzed one of each platform version and found identical codebases. Hunt.io assessed with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language.
What Makes This Attack Different?
This case differs from previously reported AI-assisted attacks because the agent ran on the operator’s own infrastructure with no vendor oversight. When Anthropic disclosed a Chinese group using Claude Code for espionage in November, attackers had to trick the model into cooperating, and Anthropic banned their accounts once discovered. Hermes runs locally without account-based restrictions.
Thailand’s national CERT and cybersecurity agency were notified on July 15, though neither had published information as of July 24. No recovered files showed data leaving the network, and the initial entry method remains unknown. The exposure occurred through directory listing being enabled on the web server, not through any security control detecting autonomous agent activity.
Source: The Hacker News