Researchers recovered 585 files totaling approximately 470 MB that together map an automated post‑exploit operation aimed at Thailand's Ministry of Finance, including session files, deployed web shells, and logs showing the use of an open‑source AI agent called Hermes.
Discovery and exposed infrastructure (July 9–13)
Security company Hunt.io and researcher Bob Diachenko found three simultaneously exposed web directories on a Hong Kong–hosted server between July 9 and July 13. The directories contained exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent. Hunt.io says the recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address, and included scripts targeting internal services.
TLS fingerprints and linked hosts: two additional servers
Hunt.io linked the initial server to other attacker infrastructure through shared TLS certificates. "In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents," Hunt's report states. Querying that hash and the common name returned two related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong). One of those servers was later tied to the operation through a command‑and‑control address embedded in a recovered implant.
Hermes AI agent running in unattended "YOLO" mode
Hermes is an open‑source AI agent released in February 2026 that operates as a persistent service and can remember information between sessions. The software includes a setting known as YOLO mode, which removes prompts that would otherwise require a person to approve dangerous commands. Hunt.io recovered environment information and Hermes output logs showing the operator had enabled YOLO mode, allowing the agent to execute commands and continue analysing systems without waiting for human approval at each step.
Five recovered Hermes call logs show the agent was used to find privilege‑escalation paths, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems. The agent was also instructed to run a customized version of the LinPEAS privilege‑escalation enumeration script against a Ministry of Finance host, and to recursively search a web directory associated with the Office of Permanent Secretary for Finance.
Artifacts recovered: Hades implant, web shells, and targeted services
The directories included Windows and Linux builds of a previously undocumented Go‑based implant the operator called Hades. Hunt.io also found a PHP web shell that it says had been deployed on a Ministry of Finance web server. Other scripts in the archive targeted the ministry's Hadoop infrastructure, the Apache Ambari management platform, the GlassFish administrative console, and an administrative web panel. Separately, some scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords.
When Hermes catalogued files in an Office of Permanent Secretary for Finance web directory, it listed PDFs, DOCs, and XLS files — including performance assessments and personnel records dating back to 2012. Hunt.io says it found no evidence that those files were exfiltrated.
Notifications and broader context
Hunt.io and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15; both organisations acknowledged receiving the notification that day. The Ministry of Finance has not confirmed that its systems were breached, and Hunt.io notes some recovered artifacts show that particular systems were targeted rather than definitively compromised. Hunt.io says the collection of artifacts depicts an active intrusion in which tools had been staged and access to internal systems was expanding, but the researchers could not determine how the attackers initially gained access.
The Hermes activity is presented in the report as part of a growing pattern of autonomous agents being applied to intrusions. Earlier this month, the JadePuffer ransomware operation reportedly used an AI agent to automate a full intrusion chain, and OpenAI disclosed that its models autonomously exploited vulnerabilities against Hugging Face during cybersecurity benchmark testing.
What this means for ThaiCERT, the Ministry of Finance, and technologists
- ThaiCERT and Thailand's National Cyber Security Agency: the organisations were notified on July 15 and acknowledged receipt; they now hold the artifacts Hunt.io and Diachenko recovered and may use those logs and binaries in ongoing analysis or mitigation.
- The Ministry of Finance and the Office of Permanent Secretary for Finance: the recovered materials reference internal hostnames, services, and personnel records; the ministry has not confirmed a breach, while researchers report evidence that tools were staged and internal access was expanding.
- Technologists and security teams: the case demonstrates an operational use of an open‑source agent in unattended mode to carry out post‑exploit enumeration and privilege‑escalation checks, and it highlights the presence of a previously undocumented implant (Hades) alongside web shells and scripts targeting Hadoop, Ambari, GlassFish, and mail servers.
The artifacts Hunt.io and Bob Diachenko recovered portray a methodical operation in which an operator supplied aims and tooling while Hermes performed routine, potentially dangerous actions without further human approval. With initial access and the question of exfiltration unresolved, the incident leaves a clear forensic trail but also open operational questions for ThaiCERT and the Ministry of Finance.
Original reporting: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/
