Unattended Hermes AI Agent Used in Targeting of Thailand Finance Ministry, Researchers Find

Jul 23, 2026 · Original article ↗

Summary

Hunt.io researchers found an unattended Hermes agent, Hades implant, web shells and tailored attack tools targeting Thailand’s Ministry of Finance. Evidence indicates access to multiple systems; the initial access method and any data exfiltration remain unconfirmed.

Key points

Researchers recovered three exposed directories on a Hong Kong-hosted server, containing 585 files and 470 MB of attack tools and credentials.
Hermes logs show the agent ran in unattended “YOLO” mode, enumerated ministry hosts and files, and ran privilege-escalation checks.
Recovered session material, a deployed web shell and internal network access indicate compromise of multiple ministry systems; the initial access method is unknown.
A custom cross-platform Go implant, Hades, supports command execution, persistence, file transfer and HTTPS command-and-control.
Targeting tools included scripts for Hadoop HiveServer2 and Ambari, GlassFish, ministry mail systems and privilege-escalation exploits.
Researchers found no evidence that files were exfiltrated; they recommend reviewing HiveServer2 authentication and UDF controls, auditing web roots and patching affected systems.

Article Details

Attack Vectors: Initial access to Thailand's Ministry of Finance network was not established from the recovered files.
A staged HiveServer2 script attempts SASL PLAIN authentication with default credentials, registers a malicious Java UDF to execute shell commands, and retrieves output through WebHDFS.
GlassFish scripts attempt to authenticate to an internal admin console with default credentials and deploy JSP web shells packaged as WAR files. Successful deployment of those WAR files was not confirmed.
A PHP web shell disguised as a Linux journal cache file was deployed on a ministry web server.
Perl and Python scripts test ministry mailbox credentials; other staged code targets sudo, polkit pkexec, and IIS 6.0 WebDAV vulnerabilities.
Recovered Hermes logs show unattended agent activity involving host and file enumeration and privilege-escalation assessment. No exfiltration of the enumerated files was evidenced.
Analyzed Hades builds communicate with hardcoded controllers over HTTPS. The builds include persistence, proxy, file-transfer, and platform-specific execution capabilities.
Defensive Notes: Review HiveServer2 authentication mode and enforce its UDF blocklist.
Recursively audit web roots for PHP files with leading-dot names that imitate system files.
Patch sudo to 1.9.5p2 or later and check polkit versions for CVE-2021-4034.
Disable WebDAV on remaining IIS 6.0 instances or migrate off the platform.
Alert when web server processes connect to internal service ports such as 10000 or 50070.
Change default GlassFish admin-console credentials and restrict console access to trusted networks.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`redhatupdating432[.]dnsrd[.]com`	Domain resolving to the staging server; the article notes its presence predates the observed ministry activity.
IPV4	`103[.]97[.]0[.]57`	SSH client address in the recovered Hermes configuration, identified as an operator access host for the staging server.
IPV4	`118[.]107[.]222[.]232`	Additional server linked to the operator infrastructure through the shared TLS certificate fingerprint.
IPV4	`202[.]181[.]27[.]115`	Server linked through TLS certificates and hardcoded as a controller in an analyzed Hades Linux binary.
IPV4	`43[.]246[.]208[.]207`	Operator staging server with exposed attack directories; also hosted a VShell C2 server and was a hardcoded Hades controller.
SHA256	`0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc`	VShell Linux stage-one payload recovered from the server.
SHA256	`2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d`	TLS certificate fingerprint listed for a server linked to the operator infrastructure.
SHA256	`5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753`	TLS certificate fingerprint listed for the operator staging server.
SHA256	`576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e49`	TLS certificate fingerprint listed for the operator staging server.
SHA256	`58338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a`	TLS certificate fingerprint listed for a server also identified as a Hades controller.
SHA256	`9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aa`	TLS certificate fingerprint listed for the operator staging server.
SHA256	`a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509`	VShell Windows stage-one payload recovered from the server.
SHA256	`b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53`	VShell Windows stage-two payload recovered from the server.
SHA256	`d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2`	Analyzed Hades Linux binary, multipathd_04d0.
SHA256	`dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123b`	TLS certificate fingerprint listed for the operator staging server.
SHA256	`ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2`	VShell Linux stage-two payload recovered from the server.
SHA256	`ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81`	TLS certificate fingerprint listed for a server also identified as a Hades controller.