Hermes AI Agent Used to Automate Post-Exploitation in Alleged Thai Finance Ministry Intrusion
Summary
Researchers found exposed files and Hermes logs linked to an alleged Thai Finance Ministry intrusion. The ministry has not confirmed a breach; researchers found no evidence that searched documents were exfiltrated.
Key points
- Hunt.io and researcher Bob Diachenko found three exposed directories containing 585 files linked to the alleged operation.
- The files included web shells, credentials, exploit code, payloads, and logs referencing ministry systems.
- Recovered logs indicate an operator used Hermes in unattended YOLO mode for privilege escalation, scanning, service enumeration, and file-system searches.
- Some scripts targeted Hadoop, Apache Ambari, GlassFish, and ministry mail servers; researchers say a web shell was deployed on a ministry server.
- A Hermes task cataloged documents and personnel records, but researchers found no evidence those files were exfiltrated.
- The ministry has not confirmed a breach; the initial access method remains unknown, and some artifacts show targeting rather than successful compromise.
Article Details
- Victim Organization
- Thailand Ministry of Finance
- Incident Type
- Alleged intrusion involving web shells and post-exploitation activity, including privilege-escalation attempts, system enumeration, and traversal of internal systems.
- Data Types Exposed
- Credentials found in recovered attacker directories; their scope and validity are not specified.
- Personnel records and performance assessments were cataloged by the agent; Hunt.io found no evidence that these files were exfiltrated.
- Affected Records
- Unknown
- Affected Data Size
- Unknown; the recovered attacker directories contained 585 files totaling approximately 470 MB, but this was not identified as stolen victim data.
- Operational Impact
- Hunt.io says artifacts indicate multiple ministry systems were compromised and access to internal systems was expanding. The Ministry has not confirmed a breach, and some artifacts show targeting rather than successful compromise.
- Ransom Or Extortion
- None reported.
- Claim Status
- alleged
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 118[.]107[.]222[.]232 | Host linked to the operation as related attacker-controlled infrastructure through shared TLS certificate characteristics, according to the report. |
| IPV4 | 202[.]181[.]27[.]115 | Host linked to the operation as related attacker-controlled infrastructure through shared TLS certificate characteristics, according to the report. |
MITRE ATT&CK
T1046 · Network Service DiscoveryRecovered logs show the agent was used to scan and enumerate services.T1068 · Exploitation for Privilege EscalationRecovered Hermes logs show the agent was used to seek privilege escalation and scan for kernel vulnerabilities; successful escalation is not established.T1083 · File and Directory DiscoveryThe agent was instructed to search a web directory recursively and catalog files.
People
Malware
Products
Apache AmbariSome scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel.Apache HadoopSome scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel.GlassFishSome scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel.
Tools
HermesA threat actor allegedly used the open-source Hermes AI agent in unattended YOLO mode to automate post-exploitation tasks during an intrusion tied to Thailand’s Ministry of Finance.LinPEASHermes was also told to use a customized version of the LinPEAS privilege-escalation enumeration script to collect information from a Ministry of Finance host.
Countries
Hong KongBetween July 9 and July 13, Hunt.io discovered three simultaneously exposed directories on a server hosted in Hong Kong.Malaysia“Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong).”ThailandA threat actor allegedly used the open-source Hermes AI agent in unattended YOLO mode to automate post-exploitation tasks during an intrusion tied to Thailand’s Ministry of Finance.