Threat reportThreat IntelligenceTL-2026-4098
BUGSTER: Low-Skill Financially Motivated Actor Uses AI Agents (Hermes Agent/DeepSeek V4, Cursor IDE) to Plan and Execute Multiple Cybercrime Operations
BUGSTER: Low-Skill Financially Motivated Actor Uses AI (TL-2026-4098), also tracked as AI-assisted cybercrime, is a medium-severity tracked intrusion set, first published 2026-10-22. It is attributed to BUGSTER with low confidence, affects WordPress WordPress REST API / sitemaps (user enumeration, weak, maps to 24 MITRE ATT&CK techniques (T1040, T1059.001, T1059.005), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 1BUGSTER
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-4098
- Threat ID
- TL-2026-4098
- Also known as
- AI-assisted cybercrime, Next Exploit Opportunities
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- BUGSTER
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- education, ecommerce, telecoms, cryptocurrency
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in BUGSTER: Low-Skill Financially Motivated Actor Uses AI
Malware and tooling: Cursor IDE, DeepSeek V4, GLM 5.2, Hermes Agent
How BUGSTER: Low-Skill Financially Motivated Actor Uses AI works
Unit 42 reports a financially motivated, English-speaking actor (handle BUGSTER) who used AI agents to plan and run credential brute-forcing, MongoDB data theft (5,200+ student/faculty records), API enumeration, GPU-accelerated Wi-Fi cracking, crypto-whale reconnaissance and VoIP fraud planning, primarily against Indian organizations. The actor appears to lack the skills these activities previously required.
Unit 42 (Palo Alto Networks) published on 2026-10-21 an analysis of a previously unreported actor using the handle BUGSTER (display name 'B U G S T E R', email bugstergap@gmail.com, Cursor IDE user ID 158034011, Telegram user ID 7593151260). The actor is English-speaking, financially motivated, and self-describes as a 'gamer, OSINT, VoIP entrepreneur' claiming a US LLC and EIN. Unit 42 assesses that the actor relies on AI-generated reconnaissance and scripts despite basic tooling, indicating that AI lowers the skill barrier for multi-domain cybercrime.
Tooling: the actor ran the open-source Hermes Agent framework with DeepSeek V4 as the model, controlled via Telegram direct messages, with a system prompt override that disabled safety controls. Multiple Hermes profiles were observed: make-good (general criminal assistance, /root/.hermes/profiles/make-good), alice (VoIP fraud advisor, /root/.hermes/profiles/alice), pandarouter (carrier research and routing, /root/.hermes/profiles/pandarouter), plus dev, check, vuln and deploy used via a shared Telegram group. The actor also used Cursor IDE with agent mode forced and sandbox/permission controls bypassed (via a cipher-proxy.sh script), and tested GLM 5.2 (Zhipu AI) and OpenRouter before settling on DeepSeek V4. The actor's primary server 162.243.3.92 hosted Hermes Agent, a Python C2 listener, the Cursor proxy and supporting components; 104.238.38.202 is a commercial proxy server.
Operations: (1) Against an Indian university, the actor enumerated 12 subdomains and abused WordPress REST API/post-author fields and sitemaps to extract 13 active user IDs (the direct user endpoint was blocked by a Cloudflare WAF but sitemaps were reachable), then generated a custom brute-force tool with 117 usernames and 28 passwords, recovering one valid credential. (2) Against a second Indian university, the actor dumped a MongoDB database holding more than 5,200 student and faculty records (names, contact information), and the loot manifest recorded an administrator credential with a weak password and exposed cloud infrastructure details. (3) Against an Indian e-commerce platform, API enumeration yielded a storefront API token, 3 admin emails, 2 phone numbers and payment merchant IDs, summarized in a suspected LLM-generated report with a 'NEXT EXPLOIT OPPORTUNITIES' section. (4) A Go-based credential scanner harvested .env files, S3 signed URLs, Google Cloud service account keys, CDN API keys and private keys from logs, with a companion Python domain scraper. (5) A Kali device labelled 'Pi' captured WPA PMKID/EAPOL handshakes from nearby access points, sent hashes over an SSH tunnel to Vast.ai GPU instances for cracking, and results were returned through Discord webhooks. (6) Crypto reconnaissance scraped the top 500 ETH holders and documented 45 whales via the DeBank API, with no confirmed follow-on activity. (7) VoIP fraud planning by the alice profile covered LLC/EIN formation, FCC registration, SIP trunks, a ~70% legitimate / 30% fraudulent traffic mix, STIR/SHAKEN bypass and CLI spoofing; no call logs, SIP traces or routing were observed. Additional C2 tooling included a Python listener, Base64-encoded PowerShell reverse shells delivered via VBScript, and a QubesOS VM setup script.
Unit 42 notes multiple unrelated actors are independently adopting the Hermes + DeepSeek combination, citing its earlier report on a Chinese-speaking actor (published 2026-07-30). No CVEs, file hashes or domains are disclosed in the source. Activity dates are not stated in the report; 2026-10-21 is the publication date. Severity (MEDIUM) is analyst-assigned; the source gives no CVSS or severity rating.
MITRE ATT&CK techniques used in TL-2026-4098
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1110.002 Brute Force: Password Cracking; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic
Command and Control
T1071 Application Layer Protocol; T1090.002 Proxy: External Proxy; T1572 Protocol Tunneling
Initial Access
Discovery
Collection
Defense Evasion
T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1567 Exfiltration Over Web Service; T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1583.006 Web Services; T1587.001 Malware; T1588.007 Artificial Intelligence
Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses; T1590 Gather Victim Network Information; T1594 Search Victim-Owned Websites
Impact
Affected products and versions in BUGSTER: Low-Skill Financially Motivated Actor Uses AI
- WordPress — WordPress REST API / sitemaps (user enumeration, weak credentials)
Vulnerable versions: Misconfigured deployments - MongoDB — MongoDB (weakly protected administrator credential)
Vulnerable versions: Misconfigured deployments - Various — Indian e-commerce platform APIs and wireless networks
Vulnerable versions: Not specified
Remediation for BUGSTER: Low-Skill Financially Motivated Actor Uses AI
Immediate actions
- Block and hunt for 162.243.3.92 and 104.238.38.202 in proxy, firewall, DNS and NetFlow logs
- Audit MongoDB instances for internet exposure, authentication and weak administrator passwords; rotate credentials
- Rotate any API tokens, cloud keys and .env secrets exposed in web roots, logs or public storage
- Review WordPress sites for user enumeration via REST API, author archives and sitemaps; reset weak or reused credentials
Workarounds
- Restrict REST API user endpoints and disable author/user disclosure in sitemaps
- Restrict MongoDB to private networks with authentication enabled
Longer-term hardening
- Enforce MFA and strong password policy on WordPress, admin and database accounts
- Rate-limit and monitor authentication endpoints for high-volume username/password combinations
- Scan code, logs and storage for secrets (.env files, S3 signed URLs, GCP service account keys, private keys)
- Inventory and monitor use of AI agent frameworks (Hermes Agent, Cursor with sandbox disabled) on managed endpoints
- Harden wireless networks with WPA3 or WPA2-Enterprise and long random passphrases to resist offline cracking
Weaknesses (CWE) in BUGSTER: Low-Skill Financially Motivated Actor Uses AI
Timeline of BUGSTER: Low-Skill Financially Motivated Actor Uses AI
- Related (unattributed to BUGSTER): Unit 42 later reported observing a Hermes Agent autonomous attack session on this date by a separate Chinese-speaking actor, showing the Hermes + DeepSeek toolchain in criminal use.
- The Hacker News and other outlets covered Unit 42's earlier Hermes Agent + DeepSeek report, establishing context for the toolchain later seen in BUGSTER's operations.
- Unit 42 published 'Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks', the earlier report on the Hermes Agent + DeepSeek combination.
- Unit 42 assessed that multiple unrelated actors are independently adopting Hermes + DeepSeek, suggesting a prevalent toolchain among AI-enabled cybercriminals.
- Unit 42 documented seven BUGSTER operations: WordPress brute-force of an Indian university (117 usernames, 28 passwords, one valid credential), MongoDB theft of 5,200+ records from a second university, e-commerce API enumeration, Go credential scanning, Vast.ai Wi-Fi cracking, ETH whale recon (45 profiles) and VoIP fraud planning. Underlying dates are not given.
- Unit 42 disclosed actor infrastructure 162.243.3.92 (primary server) and 104.238.38.202 (commercial proxy), plus the actor email, Cursor user ID 158034011 and Telegram user ID 7593151260.
- Unit 42 published its analysis of BUGSTER, a previously unreported actor, covering WordPress brute-forcing, MongoDB exfiltration of 5,200+ records, API enumeration, Wi-Fi cracking, crypto recon and VoIP fraud planning. The report does not give dates for the underlying activity.
Sources cited for BUGSTER: Low-Skill Financially Motivated Actor Uses AI
- "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
- Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (Unit 42)
- Hacker uses DeepSeek AI to autonomously attack vulnerable servers (BleepingComputer)
- Chinese hacker commands DeepSeek via Hermes (The Hacker News)
- AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek (Security Affairs)
- China-based hacker DeepSeek autonomous (Cybersecurity Dive)
Detection coverage for TL-2026-4098
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4098 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.