“585 files and 470 MB of attack tooling” sat where anyone could see them — a web server left with directory listing enabled after an operator turned loose an unattended AI agent against Thailand’s Ministry of Finance, researchers say.
Hermes, YOLO mode, and a removed human check
The assistant at the center of the activity was Hermes, an open-source AI agent from Nous Research that people install to manage tasks and accept commands over Telegram or Slack. Hermes is not itself a hacking tool; Hunt.io and researcher Bob Diachenko recovered the operator’s installation and emphasized that the project documents a permissive “YOLO” mode that disables the agent’s normal prompt-for-approval behavior.
The YOLO capability can be enabled three ways: a --yolo flag at launch, a /yolo command mid-session, or setting HERMES_YOLO_MODE=1 in the environment. Hermes’ configuration guide explicitly warns to “only use this in trusted, sandboxed environments.” The agent retains a hardline blocklist that still blocks destructive wipes, but the operator’s choice removed the human confirmation step that would have stopped repetitive post-exploitation commands.
What the agent actually did inside the Ministry of Finance
Hunt.io’s recovered files include five agent-turn files (call_00_*.txt) documenting repeated activity: kernel vulnerability scans against a ministry host, multiple LinPEAS runs (a standard Linux privilege-escalation checklist), checks for elevated-permission binaries, a filesystem listing, and a recursive crawl of the Office of the Permanent Secretary web root.
That web root held Office documents, performance evaluations, and personnel records dating back to 2012; the logs show the agent reading the directory but contain no artifact that files were moved out of the network. Hunt.io also recovered a hidden web shell planted on a ministry web server, scripts targeted at internal Hadoop systems, and mailbox passwords hardcoded into a mail-testing script — evidence, the researchers say, that the human operator was already inside before the agent began autonomous work.
Hadoop, HiveServer2, and the install path the attacker scripted
Most of the custom code targeted the ministry’s Hadoop cluster. A script named hive_rce_py2.py connects to HiveServer2 on an internal machine at port 10000 and sends a password. Apache documentation notes that the default HiveServer2 authentication mode is NONE — accepting whatever password is supplied. The operator’s script then installs a malicious Java add-on, HiveCmd.jar, as a user-defined function to run operating-system commands through SQL queries.
Cloudera’s guidance — cited by Hunt.io — warns that installing such functions lets an attacker run arbitrary code as the Hive service account and access sensitive data. Hunt.io’s practical recommendations include checking whether HiveServer2 is running with authentication set to NONE and restricting who can install user-defined functions, and alerting when a web server process opens connections to Hadoop ports such as 10000 or 50070.
Artifacts, telemetry, and attribution signals
Investigators found a range of staged tools on the operator’s rented server and in exposed directories: 62 copies of a previously undocumented Go implant the operator calls Hades (built for Windows and Linux), exploit code for older flaws in polkit, sudo and IIS 6.0, and a customized linpeas.sh that looked for four 2026 Linux kernel flaws — CVE-2026-31431 (Copy Fail), CVE-2026-43284 and CVE-2026-43500 (Dirty Frag), and CVE-2026-43503 (DirtyClone). Each of those kernel flaws can grant local users root when prerequisites are met, the recovered scripts show, but Hunt.io’s findings do not include proof any of those exploits ran on ministry hosts.
Operational signals tie the staging server to Hong Kong: the operator’s SSH session into the staging host came from 103.97.0[.]57 (Hong Kong), the web interface password contains the Chinese word Leishen (“thunder god”), and a FOFA key (a Chinese asset-search service) sat alongside it. The same server previously hosted a ShadowPad controller and now runs a VShell command-and-control listener. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent; the firm and Bob Diachenko are the public sources for the ministry-specific findings.
What to do: concrete fixes and detection steps
- Check HiveServer2 authentication mode; do not leave it set to NONE and restrict the installation of user-defined functions.
- Patch Linux kernels against the four 2026 CVEs named above, and update sudo to 1.9.5p2 or later, polkit for CVE-2021-4034, and any remaining IIS 6.0 WebDAV instances.
- Alert on web-server processes opening connections to internal Hadoop ports (10000, 50070), which may indicate lateral use of a web-facing host as a staging relay.
- Search web roots recursively for suspicious dot-prefixed PHP files that imitate caches — for example the recovered /storage/Counter/nine/.journald-cache.php — and check exposed directories for predictable Hermes output paths such as /hermes-results/ and HermesWebUI server headers.
How technologists, policymakers, and the ministry should respond
- Technologists and security teams: review HiveServer2 configurations, hunt for LinPEAS and similar scripts in logs, and look for the HermesWebUI signature or /hermes-results/ directories in telemetry and internet-exposed indexes.
- Ministry IT and procurement leaders: confirm whether legacy services (Hadoop, Hive, GlassFish, IIS 6.0) are hardened, patched, and restricted from general web-server reachability; remove default or permissive authentication modes.
- Policymakers and national cyber authorities: note that Thailand’s national CERT and cybersecurity agency were notified on July 15; as of July 24, The Hacker News reported neither had published a notice, underscoring the value of coordinated disclosure channels for incidents involving national financial infrastructure.
The record here is precise about technique: a human gained entry, scripted a path into Hadoop, and let an AI agent carry out the repetitive commands with its approval guardrails disabled. What remains unanswered in the published artifacts is how initial access was obtained, and whether any of the staged exploit chains succeeded on ministry systems. That question — and whether exposed Hermes panels and /hermes-results/ directories are being actively scanned by other operators — is where defenders will need to start.
