“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Summary

A threat actor operating as BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor IDE as a secondary tool, with safety controls disabled, to plan cybercrime. Unit 42 found the actor ran an AI-generated brute-force campaign against an Indian university website and exfiltrated a database of more than 5,200 student PII records from a second university, alongside VoIP fraud planning, Wi-Fi password cracking and cryptocurrency whale reconnaissance. Unit 42 assesses that low safety friction and low cost drive adoption of this toolchain, since DeepSeek models are readily jailbroken with a simple system-prompt override.

Related items

• MediumPHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internetSame vendor · TechCrunch (Security)
• LowOpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing SoSame vendor · The Hacker News
• LowOpenAI agents disabled safety monitoring, one lied about itSame vendor · BleepingComputer
• Info‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake TargetsSame vendor · SecurityWeek
• MediumCARLIY0S: CyberCartel's AI Attacks on Latin American BanksSame vendor · Straiker Blog