# BUGSTER: Low-Skill Financially Motivated Actor Uses AI Agents (Hermes Agent/DeepSeek V4, Cursor IDE) to Plan and Execute Multiple Cybercrime Operations

> Unit 42 reports a financially motivated, English-speaking actor (handle BUGSTER) who used AI agents to plan and run credential brute-forcing, MongoDB data theft (5,200+ student/faculty records), API enumeration, GPU-accelerated Wi-Fi cracking, crypto-whale reconnaissance and VoIP fraud planning, primarily against Indian organizations. The actor appears to lack the skills these activities previously required.

- **Published:** 2026-10-22T02:50:51Z
- **Last reviewed:** 2026-10-22T02:50:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4098
- **ID:** TL-2026-4098
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** BUGSTER
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Unit 42 (Palo Alto Networks) published on 2026-10-21 an analysis of a previously unreported actor using the handle BUGSTER (display name 'B U G S T E R', email bugstergap@gmail.com, Cursor IDE user ID 158034011, Telegram user ID 7593151260). The actor is English-speaking, financially motivated, and self-describes as a 'gamer, OSINT, VoIP entrepreneur' claiming a US LLC and EIN. Unit 42 assesses that the actor relies on AI-generated reconnaissance and scripts despite basic tooling, indicating that AI lowers the skill barrier for multi-domain cybercrime.

Tooling: the actor ran the open-source Hermes Agent framework with DeepSeek V4 as the model, controlled via Telegram direct messages, with a system prompt override that disabled safety controls. Multiple Hermes profiles were observed: make-good (general criminal assistance, /root/.hermes/profiles/make-good), alice (VoIP fraud advisor, /root/.hermes/profiles/alice), pandarouter (carrier research and routing, /root/.hermes/profiles/pandarouter), plus dev, check, vuln and deploy used via a shared Telegram group. The actor also used Cursor IDE with agent mode forced and sandbox/permission controls bypassed (via a cipher-proxy.sh script), and tested GLM 5.2 (Zhipu AI) and OpenRouter before settling on DeepSeek V4. The actor's primary server 162.243.3.92 hosted Hermes Agent, a Python C2 listener, the Cursor proxy and supporting components; 104.238.38.202 is a commercial proxy server.

Operations: (1) Against an Indian university, the actor enumerated 12 subdomains and abused WordPress REST API/post-author fields and sitemaps to extract 13 active user IDs (the direct user endpoint was blocked by a Cloudflare WAF but sitemaps were reachable), then generated a custom brute-force tool with 117 usernames and 28 passwords, recovering one valid credential. (2) Against a second Indian university, the actor dumped a MongoDB database holding more than 5,200 student and faculty records (names, contact information), and the loot manifest recorded an administrator credential with a weak password and exposed cloud infrastructure details. (3) Against an Indian e-commerce platform, API enumeration yielded a storefront API token, 3 admin emails, 2 phone numbers and payment merchant IDs, summarized in a suspected LLM-generated report with a 'NEXT EXPLOIT OPPORTUNITIES' section. (4) A Go-based credential scanner harvested .env files, S3 signed URLs, Google Cloud service account keys, CDN API keys and private keys from logs, with a companion Python domain scraper. (5) A Kali device labelled 'Pi' captured WPA PMKID/EAPOL handshakes from nearby access points, sent hashes over an SSH tunnel to Vast.ai GPU instances for cracking, and results were returned through Discord webhooks. (6) Crypto reconnaissance scraped the top 500 ETH holders and documented 45 whales via the DeBank API, with no confirmed follow-on activity. (7) VoIP fraud planning by the alice profile covered LLC/EIN formation, FCC registration, SIP trunks, a ~70% legitimate / 30% fraudulent traffic mix, STIR/SHAKEN bypass and CLI spoofing; no call logs, SIP traces or routing were observed. Additional C2 tooling included a Python listener, Base64-encoded PowerShell reverse shells delivered via VBScript, and a QubesOS VM setup script.

Unit 42 notes multiple unrelated actors are independently adopting the Hermes + DeepSeek combination, citing its earlier report on a Chinese-speaking actor (published 2026-07-30). No CVEs, file hashes or domains are disclosed in the source. Activity dates are not stated in the report; 2026-10-21 is the publication date. Severity (MEDIUM) is analyst-assigned; the source gives no CVSS or severity rating.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1594 Search Victim-Owned Websites
- T1588.007 Artificial Intelligence
- T1583.006 Web Services
- T1587.001 Malware
- T1110 Brute Force
- T1110.002 Brute Force: Password Cracking
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1140 Deobfuscate/Decode Files or Information
- T1090.002 Proxy: External Proxy
- T1572 Protocol Tunneling
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1087 Account Discovery
- T1040 Network Sniffing
- T1071 Application Layer Protocol
- T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook
- T1583.003 Acquire Infrastructure: Virtual Private Server

## Sources

- ["Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/)
- [Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (Unit 42)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)
- [Hacker uses DeepSeek AI to autonomously attack vulnerable servers (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/)
- [Chinese hacker commands DeepSeek via Hermes (The Hacker News)](https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html)
- [AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek (Security Affairs)](https://securityaffairs.com/?p=196544)
- [China-based hacker DeepSeek autonomous (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/china-based-hacker-deepseek-autonomous/826784/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4098