{"slug": "next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute", "title": "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities", "summary": "A threat actor using the handle BUGSTER weaponized jailbroken AI assistants to plan and execute cybercrime, including a confirmed intrusion into an Indian university that exfiltrated a database of more than 5,200 records containing student personally identifiable information, according to Palo Alto Networks' Unit 42. Unit 42 reported that BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor as a secondary tool, both with safety controls disabled, and used AI-generated scripts for a brute-force campaign against another Indian university's website along with VoIP fraud, Wi-Fi password cracking, cryptocurrency whale reconnaissance and command-and-control operations. Unit 42 said multiple unrelated actors are independently adopting the same Hermes plus DeepSeek combination, driven by low safety friction at low cost, since DeepSeek models are inexpensive, easy to access and readily jailbroken with a simple system-prompt override.", "body_md": "## \n\n“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities.\n\nOur visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types.\n\nUnit 42’s investigation into the actor’s operational environment and activities makes two things clear:\n\n- The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools.\n- Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities. The actor recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces.\n\nThe attacker’s conversations with jailbroken AI tools included getting step by step advice on how to set up a fraudulent Voice over IP (VoIP) operation. One assistant “helpfully” generated a document including a “NEXT EXPLOIT OPPORTUNITIES” section, outlining planned followup attacks.\n\nUnit 42 identified and investigated this threat actor's operational environment. There, we determined that they had weaponized an AI assistant across several types of cybercrime, including:\n\n- Credential theft and data exfiltration\n- VoIP telecommunications fraud\n- Wi-Fi password cracking\n- Cryptocurrency reconnaissance\n- Command-and-control (C2) operations\n\nAn actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safety controls disabled. The actor ran an AI-generated brute-force campaign against an Indian university’s website. The actor also achieved a confirmed intrusion against a second university, where they exfiltrated a database of more than 5,200 records, including personally identifiable information (PII) on students.\n\nThe actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders). Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations.\n\nMultiple, unrelated actors are independently adopting the same [Hermes + DeepSeek](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) combination. This suggests we may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities. We assess a key driver is low safety friction at low cost: DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override.\n\nPalo Alto Networks customers are better protected from the threats discussed above through the following products and services:\n\nThe [Unit 42 AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment) and [Unit 42 Frontier AI Defense](https://www.paloaltonetworks.com/unit42/ai-advantage) service can help identify and mitigate complex AI-enabled risks.\n\nOrganizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through [Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) and its [Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service).\n\nIf you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).\n\n| **Related Unit 42 Topics** | **[AI](https://unit42.paloaltonetworks.com/tag/ai/), [Credential Theft](https://unit42.paloaltonetworks.com/tag/credential-theft/), [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/)**  | \n\n## \n\nWe identified evidence that the threat actor leveraged AI systems for a wide range of criminal activity against multiple target networks, primarily in India. The criminal activity included:\n\n- Planning for VoIP fraud\n- Credential theft targeting several organizations\n- Wi-Fi password cracking\n- Cryptocurrency reconnaissance\n- C2 payloads\n\n### \n\n#### \n\nThe actor used AI-generated reconnaissance to conduct a methodical attack against an Indian university's online education platform. The actor’s enumeration reports exhibit structured formatting (executive summaries, severity ratings, systematic endpoint categorization) consistent with AI-generated output. The attack progressed through four stages:\n\n1. **Subdomain enumeration** : The actor identified 12 subdomains including the main WordPress site, a learning management system (LMS), student portal and administration dashboard\n2. **WordPress REST API enumeration** : The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall (WAF) that blocked direct user endpoint access\n3. **Targeted brute force** : A generator script produced a brute force tool with 117 usernames (derived from the enumeration) and 28 common passwords\n4. **Credential brute force** : The actor’s tool flagged one WordPress login as valid\n\nFigure 1 shows an excerpt from the actor's WordPress REST API enumeration report (stage 2).\n\nFigure 2 shows output from a brute force attempt that recorded a candidate credential (stage 4).\n\n#### \n\nThe actor exfiltrated a MongoDB database from a second Indian public university. The exfiltration tooling wrote a manifest alongside the dumped collections, recording the following data:\n\n- **Admin credential obtained** : An administrator account with a weak password\n- **Exfiltrated records** : Thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII\n- **Infrastructure exposed** : Cloud load balancing, edge routing, database services, and a third-party cloud storage service account\n\n#### \n\nThe actor enumerated an Indian site on a popular e-commerce platform, extracting:\n\n- A storefront API token\n- Three admin email addresses\n- Two phone numbers\n- Payment merchant IDs\n\nThe attack report is a suspected large language model (LLM)-generated document, including a NEXT EXPLOIT OPPORTUNITIES section outlining planned follow-up attacks.\n\n### \n\nWe also identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using the alice Hermes profile as an AI-powered advisor. Evidence included:\n\n- Advisory conversations\n- A detailed technical knowledge base\n- Carrier research\n\nHowever, the absence of call logs, Session Initiation Protocol (SIP) traces or active call routing suggested the operation was still in a planning or early setup phase.\n\nWith DeepSeek V4 as the underlying model, alice provided detailed, actionable criminal methodology through conversations and a comprehensive fraud knowledge base ingested into the bot. The actor developed a planned approach following an established VoIP fraud model:\n\n- **Establish a legitimate front** : Register a US limited liability company (LLC) with an employer identification number (EIN) to qualify as a telecommunications provider. The knowledge base includes detailed guidance on:\n  - Forming LLCs in Wyoming or Delaware as a non-US resident\n  - Obtaining an EIN without a Social Security number via the US Internal Revenue Service (IRS) fax\n  - Completing Federal Communications Commission (FCC) registration\n- **Obtain carrier access** : Contract with legitimate VoIP carriers to purchase call routing capacity (SIP trunks).\n- **Traffic mixing** : Route approximately 70% legitimate call traffic alongside 30% fraudulent calls to stay below carrier compliance audit thresholds.\n- **Bypass caller ID authentication** : Circumvent[STIR/SHAKEN](https://www.fcc.gov/call-authentication) , the FCC-mandated caller identity verification framework. In the advisory conversations, alice covers bypass techniques and Calling Line Identification (CLI) spoofing.\n- **Monetize** : Generate revenue with the 30% fraudulent traffic through toll fraud and other non-compliant routes. Least-cost routing (LCR) optimizes per-minute costs across carrier tiers.\n\nFigure 3 shows an excerpt from an alice conversation including the actor asking and DeepSeek advising on fraud traffic ratios and carrier evasion.\n\nThe pandarouter profile handled carrier research. The excerpt below in Figure 4 illustrates how the actor used it to investigate a wholesale VoIP carrier for regulatory vulnerabilities and past fraud.\n\n### \n\n#### \n\nThe threat actor’s infrastructure maintained a listening port for a Python-based C2 listener supporting Windows reverse shell connections. Supporting payloads include:\n\n- A Base64-encoded PowerShell reverse shell delivered via VBScript\n- A QubesOS VM setup script with SSH and ncat\n- Multiple Windows shell variants\n\n#### \n\nThe actor developed an automated Wi-Fi password cracking process. A Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points.\n\nThe server collected these hashes over an SSH tunnel and dispatched them to [Vast.ai](https://vast.ai/) cloud GPU instances for cracking, with results automatically reported back to the actor via Discord webhooks. This technique requires physical proximity to the target networks, indicating the actor had local access to the targeted locations.\n\n#### \n\nWe also identified a large Go-based credential-scanning toolkit. This toolkit scrapes webpages and extracts exposed credentials, including:\n\n- .env values\n- S3 signed URLs\n- Google Cloud service account keys\n- Content delivery network (CDN) API keys\n- Private keys in log files\n\nA companion Python script scrapes domain lists for scanning.\n\n#### \n\nThe actor scraped the top 500 ETH holders and major token holders via the [DeBank](https://debank.com/) API, producing intelligence files that documented 45 cryptocurrency whales with net worth figures. We assess this was likely for future targeting, but we were unable to identify any follow-on activity during this research.\n\n### \n\nThe threat actor used a single US-based server (162.243.3[.]92) to host multiple core services, including:\n\n- The Hermes Agent framework\n- A C2 listener\n- A Cursor integrated development environment (IDE) proxy\n- Several supporting components\n\nOur analysis of the actor’s logs and test scripts indicates that they experimented with various LLMs, including [GLM 5.2](https://z.ai/blog/glm-5.2) by Zhipu AI and other models accessed through [OpenRouter](https://openrouter.ai/). Ultimately, they chose DeepSeek V4 as the backend for operations.\n\nThe actor's test scripts show repeated attempts to defeat model safety controls with a prompt-level override. Although GLM 5.2 is an [open-weight model](https://hai.stanford.edu/ai-definitions/what-is-an-open-weight-model) that has been reported as weakly guarded, the actor built a dedicated script to send the override to GLM 5.2 and flag refusals. This is evidence of resistance the actor worked to overcome.\n\nThe actor ultimately operationalized DeepSeek V4, consistent with the minimal safety controls observed in the [Chinese-speaking activity we previously reported](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/). Figure 5 shows an example of the system prompt the actor used to override model safety controls (from the actor's model-testing scripts, e.g., test_batch1.py).\n\nTable 1 summarizes the actor's AI tool configurations.\n\n| **Tool** | **Model** | **Role** | **Safety Configuration** | \n| Hermes Agent | DeepSeek V4 | Primary AI assistant, Telegram-controlled | System prompt override | \n| Cursor IDE | Multiple models configured (Claude Opus 4.8, GPT-5.5, Composer 2.5, others) | AI-assisted code generation | Agent mode forced and permission checks bypassed via proxy environment variables; IDE sandbox set to disabled; MCP servers auto-approved | \n\nTable 1. AI tool configurations.\n\nFigure 6 shows a flowchart that illustrates the actor's infrastructure and how the AI tools interconnect.\n\nThe Hermes Agent served as the actor's primary interface, controlled via Telegram direct messages. The actor maintained three Hermes profiles as specialized AI modes, each running as a separate Telegram bot gateway spawned from the operator's session (Table 2).\n\n| **Profile** | **Command** | **Working Directory (CWD)** | **Description** | \n| make-good | hermes gateway run --profile make-good | /root/.hermes/profiles/make-good | General-purpose criminal assistant with safety overrides | \n| alice | hermes gateway run --profile alice | /root/.hermes/profiles/alice | VoIP fraud advisor; covers carrier compliance evasion, STIR/SHAKEN bypass and LLC formation | \n| pandarouter | hermes gateway run --profile pandarouter | /root/.hermes/profiles/pandarouter | VoIP route management and carrier research | \n\nTable 2. Telegram Hermes profiles.\n\nThe actor configured four additional profiles (dev, check, vuln, deploy) in a shared Telegram group. While we did not observe any chat artifacts for these profiles, the naming suggests the actor used AI to assist with development, validation, vulnerability testing and deployment automation functions.\n\nThe Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls. The configuration and the AI-generated scripts on the host shown below in Figure 7 suggest the actor used it for code development.\n\n## \n\nWe assess the actor is a financially motivated, multi-domain criminal operator with no prior reporting. The actor is English-speaking with informal, frequently broken grammar. The alice bot's stored memory describes the actor as a “gamer, OSINT, VoIP entrepreneur” claiming to hold a US LLC and EIN. Figure 8 below shows text from the pandarouter bot's stored memory, which is more candid.\n\nTable 3 lists further attribution indicators of this actor.\n\n| **Indicator** | **Value** | \n|  | bugstergap@gmail.com | \n| Display name | B U G S T E R | \n| Cursor IDE user ID | 158034011 | \n| Telegram user ID | 7593151260 | \n\nTable 3. Attribution indicators.\n\n## \n\nThis case illustrates how AI lowers the skill barrier for cybercrime. The actor used basic tooling and relied on AI-generated scripts and reconnaissance reports, but still achieved notable impact. They recovered more than 5,200 PII records and mapped multiple organizations' attack surfaces. AI enabled a single actor to operate across diverse attack types (credential theft, VoIP fraud, Wi-Fi cracking, cryptocurrency targeting) that would traditionally require distinct skill sets.\n\nThe VoIP fraud planning demonstrates a particularly notable use of AI as a domain expert. With DeepSeek V4 as the underlying model, the actor's bot profiles provided detailed, actionable criminal guidance.\n\nThis guidance included specific fraud-to-clean traffic ratios, carrier audit thresholds to stay below and operational security measures to avoid detection. The model's minimal safety controls allowed it to function as an on-demand criminal advisor, enabling the actor to acquire operational expertise through conversation rather than experience.\n\nCombining these findings with our previous reporting on a [Chinese-Speaking threat actor leveraging the Hermes + DeepSeek](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) toolchain points to growing uptake of this combination among cybercriminals.\n\nPalo Alto Networks customers are better protected from the threats discussed above through the following products:\n\n- [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) and[Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense) identify known domains and URLs associated with this activity as malicious.\n- [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and[XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to accurately detect the threats described in this article with the[Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection) , and behavioral analytics to reveal the root cause to speed up investigations.\n- [Cortex Agentic Endpoint Security](https://www.koi.ai/product/endpoint) is designed to help discover every AI artifact and AI agents activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations.\n- [Cortex Cloud](https://www.paloaltonetworks.com/resources/techbriefs/identity-threat-detection-and-response-module) is designed to protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both[cloud VM compute](https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/Endpoint-protection) and[serverless agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-security) , Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to disguise their presence, alter configurations or execute anomalous operations in the environment.\n- [Idira Privileged Access Manager (PAM](https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/cl_conjurcloudoverview.htm?tocpath=Get%20started%7C_____1) ) is designed to unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets.\n- [Idira Identity and Access Manager (IAM)](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) is designed to enable secure, unified access across human, machine, and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login, and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce to meet the security demands of today and tomorrow.\n- [Idira Secrets Manager](https://docs.cyberark.com/secrets-manager-saas/latest/en/content/resources/_topnav/cc_home.htm) is designed to help secure and automate API keys and webhook tokens just-in-time to eliminate hardcoded credentials and prevent exfiltration.\n\nThe [Unit 42 AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment) and [Unit 42 Frontier AI Defense](https://www.paloaltonetworks.com/unit42/ai-advantage) service can help identify and mitigate complex AI-enabled risks.\n\nOrganizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through [Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) and its [Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service).\n\nIf you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:\n\n- North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)\n- UK: +44.20.3743.3660\n- Europe and Middle East: +31.20.299.3130\n- Asia: +65.6983.8730\n- Japan: +81.50.1790.0200\n- Australia: +61.2.4062.7950\n- India: 000 800 050 45107\n- South Korea: +82.080.467.8774\n\nPalo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).\n\n## \n\n- 162.243.3[.]92 - actor infrastructure\n- 104.238.38[.]202 - commercial proxy server\n\n## \n\n- [Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) – Palo Alto Networks Unit 42", "url": "https://wpnews.pro/news/next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute", "canonical_source": "https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/", "published_at": "2026-10-21 14:00:24+00:00", "updated_at": "2026-10-21 14:39:51.577403+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents"], "entities": ["Unit 42", "Palo Alto Networks", "BUGSTER", "Hermes Agent", "DeepSeek V4", "Cursor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute", "markdown": "https://wpnews.pro/news/next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute.md", "text": "https://wpnews.pro/news/next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute.txt", "jsonld": "https://wpnews.pro/news/next-exploit-opportunities-how-a-threat-actor-used-ai-to-help-plan-and-execute.jsonld"}}