BUGSTER: Low-Skill Actor Runs Hermes Agent and DeepSeek V4 Across 5 Operations

Palo Alto Networks’ Unit 42 has published a case study of a single cybercriminal who used AI assistants as a stand-in for skills they did not have. The actor, who goes by the handle BUGSTER, ran Hermes Agent with DeepSeek V4 as its reasoning engine, added the Cursor IDE as a coding tool, and switched off the safety controls on both. Unit 42 says the actor used basic tooling and, despite “some apparent bumbling”, had “an impact”: they pulled more than 5,200 records from an Indian university and mapped the attack surface of several other organisations.

Unit 42 published the report on October 21, 2026. Everything below about the actor’s infrastructure, conversations and targets comes from that single report unless stated otherwise.

Actor Profile

Field	Detail (per Unit 42)
Handle	BUGSTER (display name “B U G S T E R”)
Motivation	Financially motivated, multi-domain criminal operator
Prior reporting	None found by Unit 42
Language	English-speaking, informal and frequently broken grammar
Primary targets	Organisations in India, including universities
Primary AI stack	Hermes Agent + DeepSeek V4, controlled over Telegram
Secondary AI tool	Cursor IDE with sandbox and permission checks bypassed
Hosting	A single US-based server hosting Hermes, a C2 listener and a Cursor proxy

Unit 42 describes the actor’s stored bot memory as calling them a “gamer, OSINT, VoIP entrepreneur” who claims to hold a US LLC and EIN. We treat that as the actor’s self-description, not a verified fact.

How the Toolchain Was Built

Hermes Agent was the actor’s main interface, driven through Telegram direct messages. Unit 42 found three maintained Hermes profiles, each running as its own Telegram bot gateway:

• make-good: a general-purpose assistant with safety overrides.
• alice: a VoIP fraud adviser covering carrier compliance evasion, STIR/SHAKEN bypass and LLC formation.
• pandarouter: VoIP route management and carrier research.

Four more profiles named dev, check, vuln and deploy were configured in a shared Telegram group. Unit 42 saw no chat artifacts for them and infers their purpose only from the names.

The actor tried several models. Test scripts show repeated attempts to push a prompt-level override into GLM 5.2, an open-weight model Unit 42 notes has been reported as weakly guarded, and to flag its refusals. The actor settled on DeepSeek V4. Unit 42 does not say why this actor chose DeepSeek V4. More broadly, it assesses that a key driver of the Hermes plus DeepSeek trend among cybercriminals is “low safety friction at low cost”: DeepSeek models are inexpensive, easy to access and readily jailbroken with a simple system-prompt override.

In Cursor, a proxy script set environment variables to force agent mode and bypass permission and sandbox controls. Unit 42’s table of configured models lists Claude Opus 4.8, GPT-5.5 and Composer 2.5 among others; Unit 42 describes them only as multiple models configured in the IDE. Our caution: that is not evidence those providers’ models were used for any particular attack.

What the Actor Did

WordPress brute force against an Indian university

Unit 42 describes a four-stage WordPress attack on a university’s online education platform:

1. Subdomain enumeration found 12 subdomains, including the main site, a learning management system, a student portal and an admin dashboard.
2. REST API enumeration extracted 13 active user IDs with real names from post author fields and author sitemaps, getting around a Cloudflare WAF that blocked the direct user endpoints.
3. A generator script produced a brute-force tool with 117 usernames and 28 common passwords.
4. The tool flagged one WordPress login as valid.

Unit 42 notes the enumeration reports have AI-style structure (executive summaries, severity ratings, endpoint categories).

Database exfiltration at a second university

At a second Indian public university, the actor exfiltrated a MongoDB database after obtaining an administrator account with a weak password. The tooling wrote a manifest listing thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII, plus details of exposed cloud infrastructure and a third-party cloud storage service account. Unit 42 puts the total at more than 5,200 records.

E-commerce enumeration

Against an Indian site on a popular e-commerce platform, the actor extracted a storefront API token, three admin email addresses, two phone numbers and payment merchant IDs. The accompanying attack report included a section titled “NEXT EXPLOIT OPPORTUNITIES” that Unit 42 suspects was LLM-generated.

VoIP fraud planning

The most notable use of AI was as a domain expert. Through the alice profile, DeepSeek V4 advised on a standard VoIP fraud model, per Unit 42:

• Set up a legitimate front: a Wyoming or Delaware LLC and an EIN obtained without a Social Security number, then FCC registration.
• Buy call routing capacity from legitimate carriers.
• Mix roughly 70% legitimate traffic with 30% fraudulent calls to stay under carrier audit thresholds.
• Bypass STIR/SHAKEN caller ID authentication through CLI spoofing.
• Monetise the fraudulent share through toll fraud.

Unit 42 found no call logs, SIP traces or active routing, and assesses the operation was still in planning or early setup.

Other tooling

• C2: a Python listener for Windows reverse shells, with Base64 PowerShell payloads delivered via VBScript.
• Wi-Fi cracking: a Kali device labelled “Pi” placed within range of target networks captured WPA handshakes (PMKID or EAPOL), which a server forwarded over SSH to Vast.ai GPU instances for cracking, with results posted to the actor via Discord webhooks. Unit 42 notes this requires close physical proximity and indicates the actor had local access to the targeted locations.
• Credential scanning: a Go toolkit that scrapes web pages for exposed .env values, S3 signed URLs, Google Cloud service account keys, CDN API keys and private keys in logs.
• Crypto reconnaissance: the top 500 ETH holders and major token holders pulled via the DeBank API, producing files on 45 “whales”. Unit 42 assesses this was likely for future targeting and found no follow-on activity.

Indicators

Unit 42 lists two network indicators:

• 162.243.3[.]92: actor infrastructure
• 104.238.38[.]202: commercial proxy server

The report also lists an email address, Telegram user ID and Cursor user ID as attribution indicators; we do not republish personal identifiers. Check the IPs against your logs. Unit 42 describes the second as a commercial proxy server, so a hit there is weaker evidence than a hit on the first.

Reading the Evidence Carefully

• Single primary source. The infrastructure details come from Unit 42’s visibility into the actor’s environment. We found trade press coverage (for example gbhackers) but it restates the Unit 42 findings and is not independent confirmation.
• Impact, in Unit 42’s words. Unit 42 describes “some apparent bumbling” but also “notable impact”. The confirmed outcomes it reports are one database exfiltration of 5,200+ records and one login flagged as valid; in our reading that is limited, but Unit 42 does not call it modest.
• Not the same actor as the earlier Chinese-speaking campaign. Unit 42 previously reported (July 30, 2026) a Chinese-speaking actor using the same Hermes plus DeepSeek combination who attempted to exploit over 460 targets; our earlier coverage covers that. Unit 42 says it sees multiple unrelated actors adopting the same toolchain and treats this as a possible trend. Whether the trend continues is a judgement, not a measured fact.

Defensive Guidance

The access methods here were ordinary, so ordinary controls work:

1. Block WordPress user enumeration. Restrict /wp-json/wp/v2/users and author sitemaps, and check that WAF rules cover every route that leaks usernames.
2. Rate-limit and MFA-protect logins. A 117-by-28 password list is small enough that throttling and lockouts should stop it.
3. Remove weak admin passwords from databases and consoles. Never leave MongoDB reachable with a weak administrator credential; require network allow-lists.
4. Scan your own sites for leaked secrets. The actor’s Go toolkit hunted for .env files, signed URLs and keys in logs, so look for them first.
5. For telecoms and VoIP carriers: review onboarding for new small providers, watch for sudden mixes of legitimate and short-duration traffic, and verify the identity behind new LLC-fronted accounts.
6. For AI platform operators: note that a one-line system-prompt override was enough to turn a low-cost model into an operational adviser. This is a model-safety gap, not something endpoint controls will catch.

What This Means

Unit 42’s conclusion is that AI lowered the skill barrier: one person could work across credential theft, VoIP fraud, Wi-Fi cracking, crypto targeting and C2 operations, domains that would normally need separate expertise. That is the finding to take away, with the caveat that the confirmed outcomes are limited in scope (our reading). Defenders gain little from treating BUGSTER as an advanced threat, and a lot from assuming that low-skill actors now have an on-demand adviser and will probe every weak WordPress site and unprotected database.

References

• Unit 42: “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
• Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
• gbhackers: Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
• AI Security Wire: Unit 42: DeepSeek Powers Autonomous Attack Campaign by Chinese Actor