“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

A financially motivated threat actor operating under the handle BUGSTER leveraged AI-powered tools, specifically the Hermes Agent framework with DeepSeek V4 as the reasoning engine, to plan and execute multiple cybercrime activities. The actor conducted credential theft via WordPress brute-forcing, exfiltrated over 5,200 student and faculty records from an Indian university's MongoDB database, and engaged in VoIP fraud planning, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor used a US-based server for command-and-control operations and employed AI-generated scripts and reconnaissance reports to lower the skill barrier for executing diverse attacks.

AI-extracted · verify before operational use