Cyber Espionage Attack Targets Thailand's Ministry of Finance
Operation using Hermes AI agent and Hades malware uncovered by researchers.
1Discovery of the Attack
Researchers at Hunt.io uncovered a cyber espionage operation targeting Thailand's Ministry of Finance. The attack utilized an open-source AI agent called Hermes and a new malware named Hades. The attackers' infrastructure was discovered while the operation was still ongoing.
2Tools Used
The attackers leveraged the Hermes AI agent in 'YOLO mode' to execute commands automatically. Additionally, they used a custom Go-based malware called Hades, which featured encrypted communication, persistence, file transfer, and screenshot capabilities.
3Scope of the Attack
Investigators determined that the attackers had gained access to the Ministry's internal network and compromised multiple systems. Custom scripts targeted Apache Hadoop, GlassFish, and other internal systems. Exploit codes for privilege escalation were also found staged in the infrastructure.
4AI's Role in the Operation
The Hermes AI agent autonomously performed routine tasks like network reconnaissance, file enumeration, and privilege escalation checks without operator intervention. It used open-source tools like LinPEAS to move through the network and catalog sensitive documents.
5Operation's Origins
Researchers traced the attackers' infrastructure to servers hosted in Hong Kong and Malaysia. TLS certificates and configurations in the Hades malware suggested a broader operational network. The attackers were assessed with low-to-medium confidence to be Chinese-speaking or familiar with the language.
6Emerging Cybersecurity Threat
This attack highlights the growing threat of AI-powered cyber operations. Autonomous agents like Hermes increase attackers' efficiency. For defenders, detecting and preventing such advanced attacks is becoming increasingly critical in modern cybersecurity.
Original article: Security Affairs — Tayland Maliye Bakanlığı'na Yapılan Siber Casusluk Saldırısı