Researchers at Hunt.io have uncovered an ongoing cyber-espionage operation targeting Thailand’s Ministry of Finance that demonstrates how autonomous AI agents are reshaping offensive cybersecurity operations. The investigation revealed exposed staging servers containing attack tools, stolen credentials, and a previously undocumented malware implant called Hades, alongside extensive logs showing the Hermes AI agent conducting reconnaissance activities.
What Did Researchers Discover?
Hunt.io, working jointly with security researcher Bob Diachenko, traced the activity to three publicly accessible directories exposed between July 9 and July 13 on a Hong Kong-hosted server. The exposed infrastructure contained nearly 600 files, including exploit code, web shells, custom scripts, compiled implants, and credentials specifically targeting Thailand’s Ministry of Finance. Evidence indicated that attackers had already established access to multiple internal systems, though the initial intrusion method remains unknown.
How Was the Hermes AI Agent Used?
The most significant aspect of this operation involved the deployment of Hermes, an open-source autonomous AI agent. Unlike typical chatbots, Hermes functioned as an operator assistant capable of executing commands without awaiting approval. Recovered logs showed the framework running in so-called YOLO mode, allowing potentially dangerous commands to execute automatically. The agent performed privilege escalation checks, file enumeration, service discovery, and reconnaissance across ministry systems. Logs indicated the operator instructed the agent to enumerate content directories containing PDF, DOC, XLS files, and personnel records associated with the Office of Permanent Secretary for Finance, though no evidence of exfiltration was found.
What Is the Hades Malware?
The exposed infrastructure hosted a custom Go-based malware family that researchers named Hades. Both Windows and Linux versions shared the same codebase and supported encrypted command-and-control communications, persistence, interactive shells, file transfers, SOCKS proxying, and on Windows, process hollowing and screenshot capture. Runtime variables revealed operational safeguards including configurable working hours and kill dates designed to reduce the implant’s visibility.
What Infrastructure Was Targeted?
Custom scripts specifically targeted Apache Hadoop infrastructure through HiveServer2, abusing default authentication behavior and malicious Hive user-defined functions to execute operating system commands. Additional tooling focused on Apache Ambari management servers, GlassFish administration consoles, internal web applications, ministry mail services, and document management platforms. Web shells disguised as legitimate system files were recovered alongside scripts designed to validate mailbox credentials and reuse active web sessions.
What Exploits Were Prepared?
The directories contained exploit code for well-known vulnerabilities, including PwnKit (CVE-2021-4034), the sudo heap overflow (CVE-2021-3156), and the IIS WebDAV vulnerability (CVE-2017-7269). These prepared payloads suggest attackers had multiple options depending on the operating systems encountered within the target network. The agent utilized the open-source LinPEAS tool for Linux privilege escalation to move through the network.
Who Is Behind the Attack?
While researchers stopped short of definitive attribution, they assessed with low-to-medium confidence that the operator is Chinese-speaking or closely familiar with the language. This assessment is based on the infrastructure’s historical association with ShadowPad, the presence of an active VShell command-and-control server, Hong Kong-based hosting, Chinese-language artifacts, and the use of FOFA, a Chinese internet reconnaissance platform. Additional related servers were identified in Hong Kong and Malaysia through analysis of TLS certificate characteristics and command-and-control configuration embedded in Hades.
Source: Security Affairs