CVE

CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When

Exploitation IoCs 35

Domain hermes-results

Domain magento[.]ink

Domain solidmonpe[.]com

Filename .journald-cache.php

Filename HiveCmd.jar

Filename hive_rce_py2.py

SHA-256 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a

SHA-256 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704

SHA-256 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e

SHA-256 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879

SHA-256 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5

SHA-256 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e

SHA-256 b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac

SHA-256 c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343

SHA-256 d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd

SHA-256 d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa

IP 103[.]97[.]0[.]57

IP 104[.]194[.]158[.]65

IP 104[.]248[.]131[.]53

IP 109[.]224[.]53[.]140

IP 138[.]68[.]244[.]146

IP 141[.]164[.]58[.]87

IP 147[.]182[.]224[.]216

IP 154[.]93[.]37[.]228

IP 162[.]243[.]175[.]162

IP 173[.]212[.]247[.]23

IP 185[.]21[.]136[.]6

IP 192[.]210[.]183[.]17

IP 198[.]23[.]185[.]234

IP 45[.]88[.]188[.]140

IP 72[.]61[.]89[.]179

IP 88[.]119[.]167[.]57

IP 88[.]80[.]150[.]232

IP 93[.]93[.]112[.]57

Package Hades

MITRE ATT&CK TTPs 8

Exploitation for Privilege Escalation

External Remote Services

Persistence

T1210

Exploitation of Remote Services

Lateral Movement

T1220

XSL Script Processing

Source Articles

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

unit42 Oct 15, 2026

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

A threat actor leveraged the open-source Hermes AI agent in YOLO mode to conduct unattended post-exploitation activities within Thailand's Ministry of Finance network. The attacker gained initial access via a web shell and exploited misconfigured Hadoop services with default authentication disabled. The Hermes agent performed automated reconnaissance, including kernel vulnerability scanning and file system crawling, while leaving logs exposed on a public server. The operator used Chinese-language artifacts and infrastructure linked to Hong Kong, suggesting a Chinese-speaking actor, though no specific group was attributed.

hacker-news Jul 24, 2026