CVE

CVE-2026-43284

View on NVD ↗

xfrm: esp: avoid in-place decrypt on shared skb frags

Exploitation IoCs 6

Domain hermes-results
Filename .journald-cache.php
Filename HiveCmd.jar
Filename hive_rce_py2.py
IP 103[.]97[.]0[.]57
Package Hades

MITRE ATT&CK TTPs 8

T1059.001
PowerShell
Execution
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1071.004
DNS
Command And Control
 T1090
Proxy
Command And Control
 T1133
External Remote Services
Persistence
 T1210
Exploitation of Remote Services
Lateral Movement
 T1220
XSL Script Processing
Defense Evasion
 T1566
Phishing
Initial Access

Source Articles

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
A threat actor leveraged the open-source Hermes AI agent in YOLO mode to conduct unattended post-exploitation activities within Thailand's Ministry of Finance network. The attacker gained initial access via a web shell and exploited misconfigured Hadoop services with default authentication disabled. The Hermes agent performed automated reconnaissance, including kernel vulnerability scanning and file system crawling, while leaving logs exposed on a public server. The operator used Chinese-language artifacts and infrastructure linked to Hong Kong, suggesting a Chinese-speaking actor, though no specific group was attributed.
hacker-news Jul 24, 2026