Executive Summary
“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities.
Our visibility into this specific actor’s operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types.
Unit 42’s investigation into the actor’s operational environment and activities makes two things clear:
The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools.
Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities. The actor recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces.
The attacker’s conversations with jailbroken AI tools included getting step by step advice on how to set up a fraudulent Voice over IP (VoIP) operation. One assistant “helpfully” generated a document including a “NEXT EXPLOIT OPPORTUNITIES” section, outlining planned followup attacks.
Unit 42 identified and investigated this threat actor’s operational environment. There, we determined that they had weaponized an AI assistant across several types of cybercrime, including:
Credential theft and data exfiltration
VoIP telecommunications fraud
Wi-Fi password cracking
Cryptocurrency reconnaissance
Command-and-control (C2) operations
An actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safety controls disabled. The actor ran an AI-generated brute-force campaign against an Indian university’s website. The actor also achieved a confirmed intrusion against a second university, where they exfiltrated a database of more than 5,200 records, including personally identifiable information (PII) on students.
The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders). Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations.
Multiple, unrelated actors are independently adopting the same Hermes + DeepSeek combination. This suggests we may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities. We assess a key driver is low safety friction at low cost: DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override.
Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:
The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.
Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.
If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.
Technical Analysis
We identified evidence that the threat actor leveraged AI systems for a wide range of criminal activity against multiple target networks, primarily in India. The criminal activity included:
Planning for VoIP fraud
Credential theft targeting several organizations
Wi-Fi password cracking
Cryptocurrency reconnaissance
C2 payloads
Credential Theft and Data Exfiltration
WordPress Brute Force
The actor used AI-generated reconnaissance to conduct a methodical attack against an Indian university’s online education platform. The actor’s enumeration reports exhibit structured formatting (executive summaries, severity ratings, systematic endpoint categorization) consistent with AI-generated output. The attack progressed through four stages:
Subdomain enumeration: The actor identified 12 subdomains including the main WordPress site, a learning management system (LMS), student portal and administration dashboard
WordPress REST API enumeration: The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall (WAF) that blocked direct user endpoint access
Targeted brute force: A generator script produced a brute force tool with 117 usernames (derived from the enumeration) and 28 common passwords
Credential brute force: The actor’s tool flagged one WordPress login as valid
Figure 1 shows an excerpt from the actor’s WordPress REST API enumeration report (stage 2).
Figure 1. Example of a WordPress REST API enumeration report from the activity.
Figure 2 shows output from a brute force attempt that recorded a candidate credential (stage 4).
Figure 2. Brute force tool output recording a candidate credential.
University Database Exfiltration
The actor exfiltrated a MongoDB database from a second Indian public university. The exfiltration tooling wrote a manifest alongside the dumped collections, recording the following data:
Admin credential obtained: An administrator account with a weak password
Exfiltrated records: Thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII
Infrastructure exposed: Cloud load balancing, edge routing, database services, and a third-party cloud storage service account
E-Commerce Enumeration
The actor enumerated an Indian site on a popular e-commerce platform, extracting:
A storefront API token
Three admin email addresses
Two phone numbers
Payment merchant IDs
The attack report is a suspected large language model (LLM)-generated document, including a NEXT EXPLOIT OPPORTUNITIES section outlining planned follow-up attacks.
VoIP Telecommunications Fraud
We also identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using the alice Hermes profile as an AI-powered advisor. Evidence included:
Advisory conversations
A detailed technical knowledge base
Carrier research
However, the absence of call logs, Session Initiation Protocol (SIP) traces or active call routing suggested the operation was still in a planning or early setup phase.
With DeepSeek V4 as the underlying model, alice provided detailed, actionable criminal methodology through conversations and a comprehensive fraud knowledge base ingested into the bot. The actor developed a planned approach following an established VoIP fraud model:
Establish a legitimate front: Register a US limited liability company (LLC) with an employer identification number (EIN) to qualify as a telecommunications provider. The knowledge base includes detailed guidance on:
Forming LLCs in Wyoming or Delaware as a non-US resident
Obtaining an EIN without a Social Security number via the US Internal Revenue Service (IRS) fax
Completing Federal Communications Commission (FCC) registration
Obtain carrier access: Contract with legitimate VoIP carriers to purchase call routing capacity (SIP trunks).
Traffic mixing: Route approximately 70% legitimate call traffic alongside 30% fraudulent calls to stay below carrier compliance audit thresholds.
Bypass caller ID authentication: Circumvent STIR/SHAKEN, the FCC-mandated caller identity verification framework. In the advisory conversations, alice covers bypass techniques and Calling Line Identification (CLI) spoofing.
Monetize: Generate revenue with the 30% fraudulent traffic through toll fraud and other non-compliant routes. Least-cost routing (LCR) optimizes per-minute costs across carrier tiers.
Figure 3 shows an excerpt from an alice conversation including the actor asking and DeepSeek advising on fraud traffic ratios and carrier evasion.
Figure 3. Excerpt from the alice conversation.
The pandarouter profile handled carrier research. The excerpt below in Figure 4 illustrates how the actor used it to investigate a wholesale VoIP carrier for regulatory vulnerabilities and past fraud.
Figure 4. Using the pandarouter profile to investigate a carrier.
Other Operations
Command and Control
The threat actor’s infrastructure maintained a listening port for a Python-based C2 listener supporting Windows reverse shell connections. Supporting payloads include:
A Base64-encoded PowerShell reverse shell delivered via VBScript
A QubesOS VM setup script with SSH and ncat
Multiple Windows shell variants
Wi-Fi Password Cracking
The actor developed an automated Wi-Fi password cracking process. A Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points.
The server collected these hashes over an SSH tunnel and dispatched them to Vast.ai cloud GPU instances for cracking, with results automatically reported back to the actor via Discord webhooks. This technique requires physical proximity to the target networks, indicating the actor had local access to the targeted locations.
Credential Scanning Toolkit
We also identified a large Go-based credential-scanning toolkit. This toolkit scrapes webpages and extracts exposed credentials, including:
.env values
S3 signed URLs
Google Cloud service account keys
Content delivery network (CDN) API keys
Private keys in log files
A companion Python script scrapes domain lists for scanning.
Cryptocurrency Reconnaissance
The actor scraped the top 500 ETH holders and major token holders via the DeBank API, producing intelligence files that documented 45 cryptocurrency whales with net worth figures. We assess this was likely for future targeting, but we were unable to identify any follow-on activity during this research.
Tool Design and Infrastructure
The threat actor used a single US-based server (162.243.3[.]92) to host multiple core services, including:
The Hermes Agent framework
A C2 listener
A Cursor integrated development environment (IDE) proxy
Several supporting components
Our analysis of the actor’s logs and test scripts indicates that they experimented with various LLMs, including GLM 5.2 by Zhipu AI and other models accessed through OpenRouter. Ultimately, they chose DeepSeek V4 as the backend for operations.
The actor’s test scripts show repeated attempts to defeat model safety controls with a prompt-level override. Although GLM 5.2 is an open-weight model that has been reported as weakly guarded, the actor built a dedicated script to send the override to GLM 5.2 and flag refusals. This is evidence of resistance the actor worked to overcome.
The actor ultimately operationalized DeepSeek V4, consistent with the minimal safety controls observed in the Chinese-speaking activity we previously reported. Figure 5 shows an example of the system prompt the actor used to override model safety controls (from the actor’s model-testing scripts, e.g., test_batch1.py).
Figure 5. Example of a system prompt to override model safety.
Table 1 summarizes the actor’s AI tool configurations.
Tool
Model
Role
Safety Configuration
Hermes Agent
DeepSeek V4
Primary AI assistant, Telegram-controlled
System prompt override
Cursor IDE
Multiple models configured (Claude Opus 4.8, GPT-5.5, Composer 2.5, others)
AI-assisted code generation
Agent mode forced and permission checks bypassed via proxy environment variables; IDE sandbox set to disabled; MCP servers auto-approved
Table 1. AI tool configurations.
Figure 6 shows a flowchart that illustrates the actor’s infrastructure and how the AI tools interconnect.
Figure 6. Actor infrastructure and AI tool relationships.
The Hermes Agent served as the actor’s primary interface, controlled via Telegram direct messages. The actor maintained three Hermes profiles as specialized AI modes, each running as a separate Telegram bot gateway spawned from the operator’s session (Table 2).
Profile
Command
Working Directory (CWD)
Description
make-good
hermes gateway run –profile make-good
/root/.hermes/profiles/make-good
General-purpose criminal assistant with safety overrides
alice
hermes gateway run –profile alice
/root/.hermes/profiles/alice
VoIP fraud advisor; covers carrier compliance evasion, STIR/SHAKEN bypass and LLC formation
pandarouter
hermes gateway run –profile pandarouter
/root/.hermes/profiles/pandarouter
VoIP route management and carrier research
Table 2. Telegram Hermes profiles.
The actor configured four additional profiles (dev, check, vuln, deploy) in a shared Telegram group. While we did not observe any chat artifacts for these profiles, the naming suggests the actor used AI to assist with development, validation, vulnerability testing and deployment automation functions.
The Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls. The configuration and the AI-generated scripts on the host shown below in Figure 7 suggest the actor used it for code development.
Figure 7. Configuration info on the host.
Attribution
We assess the actor is a financially motivated, multi-domain criminal operator with no prior reporting. The actor is English-speaking with informal, frequently broken grammar. The alice bot’s stored memory describes the actor as a “gamer, OSINT, VoIP entrepreneur” claiming to hold a US LLC and EIN. Figure 8 below shows text from the pandarouter bot’s stored memory, which is more candid.
Figure 8. Text from the pandarouter bot’s stored memory.
Table 3 lists further attribution indicators of this actor.
Indicator
Value
Email
bugstergap@gmail.com
Display name
B U G S T E R
Cursor IDE user ID
158034011
Telegram user ID
7593151260
Table 3. Attribution indicators.
Conclusion
This case illustrates how AI lowers the skill barrier for cybercrime. The actor used basic tooling and relied on AI-generated scripts and reconnaissance reports, but still achieved notable impact. They recovered more than 5,200 PII records and mapped multiple organizations’ attack surfaces. AI enabled a single actor to operate across diverse attack types (credential theft, VoIP fraud, Wi-Fi cracking, cryptocurrency targeting) that would traditionally require distinct skill sets.
The VoIP fraud planning demonstrates a particularly notable use of AI as a domain expert. With DeepSeek V4 as the underlying model, the actor’s bot profiles provided detailed, actionable criminal guidance.
This guidance included specific fraud-to-clean traffic ratios, carrier audit thresholds to stay below and operational security measures to avoid detection. The model’s minimal safety controls allowed it to function as an on-demand criminal advisor, enabling the actor to acquire operational expertise through conversation rather than experience.
Combining these findings with our previous reporting on a Chinese-Speaking threat actor leveraging the Hermes + DeepSeek toolchain points to growing uptake of this combination among cybercriminals.
Palo Alto Networks customers are better protected from the threats discussed above through the following products:
Advanced URL Filtering and Advanced IP Defense identify known domains and URLs associated with this activity as malicious.
Cortex XDR and XSIAM are designed to accurately detect the threats described in this article with the Malware Prevention Engine, and behavioral analytics to reveal the root cause to speed up investigations.
Cortex Agentic Endpoint Security is designed to help discover every AI artifact and AI agents activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations.
Cortex Cloud is designed to protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute and serverless agents, Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to disguise their presence, alter configurations or execute anomalous operations in the environment.
Idira Privileged Access Manager (PAM) is designed to unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets.
Idira Identity and Access Manager (IAM) is designed to enable secure, unified access across human, machine, and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login, and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce to meet the security demands of today and tomorrow.
Idira Secrets Manager is designed to help secure and automate API keys and webhook tokens just-in-time to eliminate hardcoded credentials and prevent exfiltration.
The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.
Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.
If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:
North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
UK: +44.20.3743.3660
Europe and Middle East: +31.20.299.3130
Asia: +65.6983.8730
Japan: +81.50.1790.0200
Australia: +61.2.4062.7950
India: 000 800 050 45107
South Korea: +82.080.467.8774
Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.
Indicators of Compromise
162.243.3[.]92 – actor infrastructure
104.238.38[.]202 – commercial proxy server
Click Here For The Original Source.
——————————————————–
