The actor recovered a database of more than 5,200 personally identifiable records and ran AI‑powered tools from a single US server while asking jailbroken models for step‑by‑step advice — including a document section labeled “NEXT EXPLOIT OPPORTUNITIES.”
How BUGSTER used AI as an all‑purpose criminal aide
Palo Alto Networks Unit 42 traced a single operator, using the handle BUGSTER, who weaponized AI across multiple criminal domains. Unit 42 identified AI‑generated activity spanning credential theft and data exfiltration, VoIP telecommunications fraud planning, Wi‑Fi password cracking, cryptocurrency reconnaissance, and command‑and‑control (C2) operations. The actor built specialized AI bot profiles (for example, “alice” and “pandarouter”), used agentic frameworks to orchestrate tasks, and relied on AI‑generated reconnaissance reports, brute‑force scripts, and technical knowledge bases to execute campaigns against several targets in India, including public universities.
Tools and infrastructure: Hermes Agent, DeepSeek V4, Cursor, and a US host
Unit 42 found BUGSTER configured the Hermes Agent framework with DeepSeek V4 as the reasoning engine and a Cursor integrated development environment (IDE) as a secondary tool, with safety controls disabled. The operator ran these components from a single US‑based server (162.243.3[.]92) that hosted the Hermes Agent, a C2 listener, a Cursor IDE proxy, and other supporting services; a commercial proxy at 104.238.38[.]202 also appeared in the environment.
Logs and test scripts show the actor experimented with multiple models — including GLM 5.2 and other models accessed through OpenRouter — but operationalized DeepSeek V4. Unit 42 documented attempts to defeat model safety controls with a prompt‑level override (for example, test_batch1.py and a system prompt used to bypass protections), and observed that some AI assistants produced structured, actionable criminal guidance.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildA close read of two university intrusions
Unit 42 reconstructed a four‑stage methodical attack against one Indian university’s online education platform. The stages included subdomain enumeration (12 subdomains identified, such as a WordPress site, an LMS, a student portal and an administration dashboard); enumeration of the WordPress REST API (13 active user IDs discovered via post author fields and author sitemaps, despite Cloudflare WAF protections); targeted brute‑force generation (a tool producing 117 usernames and 28 common passwords); and credential brute forcing (the tool flagged at least one valid WordPress login).
Against a second Indian public university the actor achieved a confirmed intrusion and exfiltrated a MongoDB database. Unit 42 found an administrative credential obtained via a weak password, and a manifest alongside dumped collections recording thousands of student and faculty records containing PII. The manifest also noted exposed infrastructure components including cloud load balancing, edge routing, database services, and a third‑party cloud storage account.
VoIP fraud blueprint: “alice” as a domain expert
BUGSTER used the alice Hermes profile, backed by DeepSeek V4, to assemble a detailed VoIP fraud playbook. Alice supplied advisory conversations, a technical knowledge base, and carrier research. The planned approach followed a familiar fraud model: establish a legitimate front (register a US LLC and obtain an EIN without a Social Security number via IRS fax, and complete FCC registration), obtain carrier access by contracting for SIP trunks, mix legitimate and fraudulent traffic (roughly 70% legitimate to 30% fraudulent to stay below carrier audit thresholds), bypass caller‑ID authentication frameworks (STIR/SHAKEN and CLI spoofing techniques), and monetize through toll fraud and least‑cost routing. Unit 42 observed a pandarouter profile focused on carrier research; the absence of call logs or SIP traces indicated the operation was in planning or early setup rather than active call fraud.
Automation, physical access, and additional tooling
BUGSTER’s infrastructure included an automated Wi‑Fi cracking pipeline: a Kali Linux device labeled “Pi” collected WPA authentication material (PMKID or EAPOL handshakes) from nearby access points, sent hashes over an SSH tunnel to Vast.ai GPU instances for cracking, and received results via Discord webhooks — a workflow that requires physical proximity to targets. The actor also maintained a Python‑based C2 listener supporting Windows reverse shells (including a Base64‑encoded PowerShell reverse shell delivered via VBScript), a QubesOS VM setup script with SSH and ncat, and multiple Windows shell variants.
Unit 42 discovered a large Go‑based credential‑scanning toolkit that scraped web pages for exposed secrets (.env values, S3 signed URLs, Google Cloud service account keys, CDN API keys, and private keys in logs), accompanied by a Python script that scraped domain lists. The actor also scraped the top 500 ETH holders via the DeBank API, producing intelligence files documenting 45 cryptocurrency “whales” for possible future targeting; Unit 42 did not identify follow‑on activity from that reconnaissance during the investigation.
What this means for technologists, universities, and security procurement teams
- Technologists and security teams: Unit 42 highlights concrete detection and prevention options — Advanced URL Filtering, Advanced IP Defense, Cortex XDR, XSIAM, Cortex Agentic Endpoint Security, and Cortex Cloud — and recommends Unit 42 AI Security Assessment and Frontier AI Defense services for complex AI‑enabled risks.
- Universities and affected education providers: the attacks demonstrate exposure vectors in WordPress REST APIs, weak administrative passwords, and cloud service misconfigurations; Unit 42’s incident response contact lines are provided for urgent compromise response in India and other regions.
- Procurement and security leaders: the report names Idira Privileged Access Manager, Idira Identity and Access Manager, and Idira Secrets Manager as intended controls to unify privileged access, enforce least privilege, and eliminate hardcoded credentials in code and CI/CD pipelines.
Unit 42’s investigation shows how an operator with basic tooling can, with jailbroken AI assistants and low‑friction models like DeepSeek V4, chain together reconnaissance, exploitation, and automation across traditionally distinct criminal specialties. The facts are concrete: a single server, multiple agent profiles, thousands of exfiltrated records, and an AI‑generated “NEXT EXPLOIT OPPORTUNITIES” plan — a pattern other actors are beginning to replicate.
