AI Agent Attack: Thai Finance Ministry Targeted by Unattended Hermes System with Hades Implant Deployment

Key Findings

• Attacker deployed Hermes AI agent in "YOLO mode" (disabling permission checks) against Thailand's Ministry of Finance, automating reconnaissance and privilege escalation attempts
• Exposed staging server in Hong Kong contained 585 files, 470 MB of attack tooling, active AI agent logs, web shells, and stolen credentials with directory listing enabled
• Agent performed unattended reconnaissance including kernel vulnerability scanning, privilege escalation checks, and file system crawling of personnel records dating to 2012
• Custom tooling specifically targeted Hadoop databases exploiting default password acceptance and Apache services like HiveServer2
• Previously undocumented Go-based malware called Hades discovered with Windows and Linux variants supporting C2 communications, persistence, and interactive shells
• Infrastructure indicators and password choices suggest Chinese-speaking operator; no evidence of data exfiltration recovered
• Thailand's national CERT was notified July 15 but had not publicly disclosed details as of July 24

Background

Hunt.io and researcher Bob Diachenko discovered the exposed infrastructure on a Hong Kong-hosted server between July 9-13. The server contained active operational material from an ongoing intrusion targeting Thailand's Ministry of Finance, which manages the country's treasury and tax collection. The initial intrusion vector remains unknown, but the recovered files show the attacker had already established access to multiple internal systems before the AI automation began.

The Hermes AI Agent and YOLO Mode

Hermes is an open-source AI assistant from Nous Research designed for legitimate tasks like managing email and handling instructions over Telegram or Slack. It is not a hacking tool. The operator used Hermes's documented YOLO mode, which automatically executes commands without requiring human approval between each action. This mode is launched via command-line flag, mid-session command, or environment variable, and the project's own documentation warns to only use it in trusted, sandboxed environments. The operator disabled the human approval layer but retained hardline safeguards preventing commands that would destroy the host machine itself.

What distinguished this attack from previous AI-assisted intrusions is the setup. When Anthropic disclosed Chinese attackers using Claude for espionage in November, the attackers had to manipulate the model and Anthropic eventually banned their accounts. Hermes runs on the attacker's own infrastructure with no vendor oversight. The operator was already inside the ministry network before deploying the agent, meaning they had progressed past initial access.

Reconnaissance Operations

The recovered logs show five files containing the agent's execution turns. The agent performed kernel vulnerability scanning against ministry hosts, ran privilege escalation enumeration tools, searched for binaries with elevated permissions, conducted filesystem listings, and recursively crawled directories belonging to the Office of the Permanent Secretary. That crawl accessed a folder containing Office documents, performance evaluations, and personnel records going back to 2012.

The scanning scripts were customized rather than stock tools. A modified version of LinPEAS checked for four 2026-era Linux kernel vulnerabilities across the Copy Fail, Dirty Frag, and DirtyClone families. Each flaw enables local privilege escalation under specific conditions. All four vulnerabilities were weeks old when staged, and the recovered logs show no evidence that any exploit successfully executed or that the agent identified the ministry's actual kernel versions.

The logs show the agent reading files within the personnel records directory but contain no evidence of data being transmitted out of the ministry network.

Hadoop Infrastructure Targeting

The operator invested significant effort building custom tooling specifically for the ministry's Hadoop infrastructure. A script named hive_rce_py2.py connected to HiveServer2, the SQL interface to Hadoop clusters. This targeting exploited Hadoop's default configuration of accepting any password, a well-known weakness. The scripts included hardcoded credentials and malicious Hive user-defined functions that execute operating system commands and return output through WebHDFS.

Separate tooling focused on Apache Ambari management servers, GlassFish administration consoles, internal web applications, mail services, and document management platforms. The operator had deployed web shells disguised as legitimate system files alongside scripts validating mailbox credentials and reusing active web sessions.

The Hades Implant

Researchers identified a previously undocumented Go-based malware family they named Hades, with compiled versions for both Windows and Linux sharing the same codebase. The implant supports encrypted command-and-control communications, interactive shells, file transfers, SOCKS proxying, and on Windows specifically, process hollowing and screenshot capture capabilities.

The recovered Hades samples contained operational safeguards including configurable working hours and kill dates, suggesting the operator took precautions to limit the malware's visibility during non-operational periods. Analysis of TLS certificate characteristics and embedded C2 configuration identified related servers hosted across Hong Kong and Malaysia, indicating the exposed staging server represented only one component of a larger operational infrastructure.

Attribution Indicators

The staging server's SSH session originated from 103.97.0[.]57 in Hong Kong. The web interface password contains the Chinese word "Leishen" (thunder god), and a key for FOFA, a Chinese asset-search service, was stored alongside it. The same server previously hosted a ShadowPad controller and currently runs a VShell command-and-control listener. Hunt.io assessed with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese but named no specific threat group. The password list used for scanning was built from the ministry's own department abbreviations rather than a standard dictionary, showing familiarity with the target's internal organization.

Privilege Escalation Arsenal

The directories contained exploit code for well-known vulnerabilities including PwnKit (CVE-2021-4034), the sudo heap overflow (CVE-2021-3156), and the long-standing IIS WebDAV vulnerability (CVE-2017-7269). The variety of payloads suggests the attacker prepared multiple exploitation options depending on the specific operating systems and configurations encountered within the ministry network.

Operational Significance

This intrusion demonstrates how AI agents are beginning to reshape offensive operations. Rather than requiring an operator to manually type and approve each command, the attacker delegated routine reconnaissance and enumeration tasks to Hermes in YOLO mode. The agent handled repetitive actions like running scans, interpreting results, and deciding what to check next. No exotic commands or zero-day exploits were involved, and nothing recovered suggests the agent identified new vulnerabilities or independently chose its targets. The human operator performed the parts requiring actual intelligence and target knowledge. The agent simply performed at scale what a person would type, without waiting for approval between steps.

Thailand's national CERT and cybersecurity agency were notified on July 15 but had not published public disclosures as of July 24, when The Hacker News checked for updates.

Sources

• https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html
• https://securityaffairs.com/195941/hacking/thailands-ministry-of-finance-targeted-with-hermes-ai-agent-running-unattended-hades-implant-staged.html