BUGSTER Used AI Tools to Plan and Conduct Cybercrime Against Indian Organizations
Summary
Unit 42 traced BUGSTER’s AI-assisted operations against Indian organizations, including a confirmed university intrusion that exposed more than 5,200 records, plus credential attacks, Wi-Fi cracking, and VoIP fraud planning.
Key points
- BUGSTER configured Hermes Agent with DeepSeek V4 and used Cursor IDE, with safety and permission controls disabled or bypassed.
- AI-generated reconnaissance and scripts supported a brute-force campaign against an Indian university’s WordPress site; the tool identified one valid login.
- The actor exfiltrated a MongoDB database from a second Indian public university, containing more than 5,200 student and faculty records with personal information.
- The actor built AI-assisted VoIP fraud plans involving carrier access, traffic mixing, caller ID spoofing, and attempts to bypass STIR/SHAKEN; Unit 42 found no evidence of active call routing.
- A Wi-Fi cracking pipeline captured authentication material near target networks, sent it over SSH to cloud GPU instances, and returned results through Discord webhooks.
- Other activity included credential scanning, command-and-control payloads, and cryptocurrency-holder reconnaissance; Unit 42 found no follow-on activity from the latter.
Article Details
- Attack Vectors
- Enumerated university subdomains and WordPress REST API author data, then used a generated tool to brute-force logins with 117 usernames and 28 common passwords.
- Exfiltrated a MongoDB database containing more than 5,200 student and faculty records from a second Indian public university.
- Developed VoIP fraud plans involving caller ID spoofing, evasion of carrier compliance checks, and fraudulent call traffic; the source says the operation appeared to be in planning or early setup.
- Captured WPA authentication material from nearby Wi-Fi networks and sent it through an SSH tunnel to cloud GPU instances for password cracking.
- Used a Go-based toolkit to scrape webpages for exposed credentials, keys, and signed URLs.
- Hosted a Python-based C2 listener supporting Windows reverse-shell connections, with payloads including a Base64-encoded PowerShell reverse shell delivered via VBScript.
- Defensive Notes
- The article identifies Advanced URL Filtering and Advanced IP Defense as protections for known malicious domains and URLs associated with this activity.
- The article recommends Cortex XDR and XSIAM for malware prevention and behavioral analytics, and Cortex Agentic Endpoint Security for discovering and controlling AI artifacts and agent activity.
- The article recommends Cortex Cloud and Idira identity and secrets-management products for cloud posture, access control, and protection of API keys and webhook tokens.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
bugstergap@gmail[.]com | Email listed by the source as an attribution indicator for the actor operating under the handle BUGSTER. | |
| IPV4 | 104[.]238[.]38[.]202 | Listed by the source as a commercial proxy server associated with the actor's activity. |
| IPV4 | 162[.]243[.]3[.]92 | Actor infrastructure hosting the Hermes Agent framework, a C2 listener, a Cursor IDE proxy, and supporting components. |
MITRE ATT&CK
T1059.001 · PowerShellThe actor's C2 payloads included a PowerShell reverse shell.T1059.005 · Visual BasicA PowerShell reverse shell was delivered via VBScript.T1110.001 · Password GuessingThe actor used a generated tool to make password guesses against a university WordPress login.T1552.001 · Credentials In FilesA Go-based toolkit scraped webpages for exposed .env values, cloud service account keys, API keys, and private keys in log files.T1572 · Protocol TunnelingWi-Fi authentication material was sent to the actor's server over an SSH tunnel.
Threat Actors
Products
CursorThe Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls.DeepSeek V4An actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safetyHermes AgentAn actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safetyKali LinuxA Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points.MongoDBThe actor exfiltrated a MongoDB database from a second Indian public university.WordPressWordPress Brute Force