“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

What it is

Unit 42 describes an actor using the handle BUGSTER, who ran the Hermes Agent framework with DeepSeek V4 as the reasoning model and Cursor IDE as a secondary tool, both with safety controls disabled. Targets were mainly in India. The summary covers the headline activity. This note adds the technical details a defender can check against their own environment.

How it works

WordPress attack on an Indian university's online education platform. Four stages:

1. The actor found 12 subdomains, including the WordPress site, an LMS, a student portal and an admin dashboard.
2. They pulled 13 active user IDs with real names from post author fields and author sitemaps. This got around a Cloudflare WAF that blocked direct user endpoints.
3. A generated script built a brute-force tool with 117 usernames derived from the enumeration and 28 common passwords.
4. The tool flagged one valid login.

Second university. A MongoDB dump included an admin account with a weak password. The tooling wrote a manifest listing the exposed cloud load balancing, edge routing, database services and a third-party cloud storage service account.

E-commerce site. The actor pulled a storefront API token, three admin emails, two phone numbers and payment merchant IDs.

VoIP fraud plan. The plan was still in setup: Unit 42 saw no call logs, SIP traces or call routing. The knowledge base covered:

• Forming a Wyoming or Delaware LLC as a non-US resident.
• Getting an EIN by IRS fax without a Social Security number.
• Registering with the FCC.
• Sending about 70% legitimate traffic and 30% fraudulent traffic to stay under carrier audit thresholds.
• Bypassing STIR/SHAKEN and spoofing CLI.

Wi-Fi cracking. A Kali device labelled Pi sat within range of targets and captured PMKID or EAPOL handshakes. A server collected them over an SSH tunnel, sent them to Vast.ai GPU instances for cracking, and reported results through Discord webhooks. Unit 42 infers the actor had physical access to those locations.

Other tooling.

• A Python C2 listener for Windows reverse shells, with a Base64 PowerShell reverse shell delivered via VBScript.
• A Go credential scanner that scrapes pages for .env values, S3 signed URLs, Google Cloud service account keys, CDN API keys and private keys in logs.
• A DeBank API scrape of the top 500 ETH holders, producing 45 profiled whales.

Safety override. The actor tested GLM 5.2 and other models via OpenRouter, with a script that sent a prompt-level override and flagged refusals. They settled on DeepSeek V4. Cursor ran through a proxy script, cipher-proxy.sh, that set environment variables to enable full agent mode and bypass permission and sandbox controls. Hermes was driven through Telegram, with three profiles as separate bots, including alice (VoIP advisor) and pandarouter (carrier research).

What to do

Unit 42 publishes two indicators:

162.243.3[.]92    actor infrastructure (Hermes, C2 listener, Cursor proxy)
104.238.38[.]202  commercial proxy server

The rest of the page's guidance is Palo Alto product mapping (URL Filtering, Cortex XDR and others). It gives no detection queries or hardening steps.

Caveats

• Unit 42 found no follow-on activity from the crypto whale list.
• The report says Hermes plus DeepSeek is also used by an unrelated Chinese-speaking actor it reported earlier. It treats this as growing uptake, not a confirmed trend.
• Attribution is only "financially motivated, English-speaking, no prior reporting". No name or location is given.
• The page does not name the affected universities.