Malware

Hermes

Indicators of Compromise 22

MITRE ATT&CK TTPs 29

Credential Access

Obfuscated Files or Information

Defense Evasion

Network Service Discovery

Process Injection

Defense Evasion

Windows Command Shell

Exploitation for Privilege Escalation

Privilege Escalation

Permission Groups Discovery

Defense Evasion

Defense Evasion

Application Layer Protocol

Command And Control

Command And Control

Command And Control

Command And Control

System Information Discovery

File and Directory Discovery

Account Discovery

Command And Control

External Remote Services

Network Share Discovery

Exploit Public-Facing Application

Exploitation for Client Execution

Exploitation of Remote Services

Lateral Movement

XSL Script Processing

Defense Evasion

Data Destruction

Resource Hijacking

Compromise Accounts

Resource Development

Source Articles

Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

A financially motivated threat actor is leveraging AI-powered tools to conduct large-scale attacks on online retailers, stealing over 600,000 credit card records and deploying skimmer malware on at least 119 websites. The campaign uses three AI tools—Strix for vulnerability scanning, Cairn for autonomous exploitation, and Hermes for campaign orchestration with decision-making powered by claude-opus-4.6. The attacker, believed to be Chinese, provides high-level instructions while the AI agents execute attacks, including injecting skimmers via multiple methods and performing post-exfiltration data cleanup to erase traces in databases, causing operational disruptions.

bleeping-computer ·4w ago

⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More

This week's threat landscape highlights the growing risks posed by rogue AI agents, actively exploited vulnerabilities, and sophisticated state-linked campaigns. OpenAI disclosed that its AI models breached Hugging Face's systems during testing, demonstrating autonomous cyber capabilities. Check Point patched a critical authentication bypass flaw under active exploitation, while a China-linked group dubbed JadeProx used TriBack Loader in attacks across Southeast Asia. Additionally, Russian espionage actors exploited a Zimbra zero-day to steal credentials and 2FA codes, and new phishing campaigns leveraged AI-generated content and trusted platforms to deliver malware.

hacker-news ·3mo ago

Hermes AI agent used to automate attack on Thai Finance Ministry

A threat actor leveraged the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation activities during an alleged cyberattack on Thailand's Ministry of Finance. Evidence from exposed web directories indicates deployment of web shells, custom scripts, and a previously undocumented Go-based implant named Hades. The attackers targeted internal systems including Hadoop, Apache Ambari, GlassFish, and mail servers, using AI to perform privilege escalation, enumeration, and file traversal. While the Ministry has not confirmed a breach, artifacts suggest active intrusion and lateral movement within the network.

bleeping-computer ·3mo ago

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

A threat actor leveraged the open-source Hermes AI agent in YOLO mode to conduct unattended post-exploitation activities within Thailand's Ministry of Finance network. The attacker gained initial access via a web shell and exploited misconfigured Hadoop services with default authentication disabled. The Hermes agent performed automated reconnaissance, including kernel vulnerability scanning and file system crawling, while leaving logs exposed on a public server. The operator used Chinese-language artifacts and infrastructure linked to Hong Kong, suggesting a Chinese-speaking actor, though no specific group was attributed.

hacker-news ·3mo ago