Hermes AI agent automates attack on Thai Finance Ministry

A threat actor deployed the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during what appears to be an intrusion into Thailand’s Ministry of Finance network.

The activity was uncovered by threat intelligence firm Hunt.io and security researcher Bob Diachenko, who discovered several exposed web directories containing hundreds of files tied to the operation. According to Hunt.io, session logs, deployed web shells, and evidence of access to internal systems suggest the attackers compromised multiple systems within the ministry’s environment.

However, the Ministry of Finance has not confirmed a breach, and some artifacts indicate only that specific systems were targeted rather than successfully penetrated. BleepingComputer has reached out to the ministry and ThaiCERT for comment and will update this report if a response is received.

Between July 9 and July 13, Hunt.io identified three simultaneously exposed directories on a server hosted in Hong Kong. These directories contained 585 files totaling roughly 470 MB, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent.

The recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address. Scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts attempted authentication against ministry mail servers using hardcoded email addresses and passwords. Hunt.io also found a PHP web shell that had reportedly been deployed on a Ministry of Finance web server.

Researchers linked the initial server to additional attacker-controlled infrastructure through shared TLS certificates used during the same timeframe. “In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents,” Hunt’s report explained. “Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong).” One of those servers was later tied to the operation through a command-and-control address embedded in a recovered implant.

The directories also contained Windows and Linux builds of a previously undocumented Go-based implant the operator called Hades. But the more striking discovery was a collection of logs showing the attackers used the Hermes AI agent to automate parts of the cyberattack.

Hermes is an open-source AI agent released in February 2026 that runs as a persistent service and retains information between task sessions. It can interact with tools and execute commands while working on objectives set by the operator. The software includes a setting known as YOLO mode, which removes prompts requiring human approval for dangerous commands.

Recovered environment information and Hermes output logs showed the operator had enabled this unattended mode. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step. Five recovered Hermes call logs show the agent was used to find a way to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems.

Hermes was also instructed to use a customized version of the LinPEAS privilege-escalation enumeration script to gather information from a Ministry of Finance host. In another task, the operator directed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance. The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. Hunt.io found no evidence these files were exfiltrated.

The findings do not indicate that Hermes independently decided to target the ministry. Instead, the exposed logs show an operator supplying the agent with objectives and tooling while YOLO mode allowed it to carry out routine post-exploitation commands without constant supervision.

Hunt.io says the recovered artifacts depict an active intrusion in which tools had been staged and access to internal systems was expanding. However, researchers could not determine how the attackers initially gained entry. The company and Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15, and both organizations acknowledged receipt that day.

This Hermes activity is the latest example of autonomous AI agents being used to conduct cyberattacks. Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption. Autonomous agents can also cause real-world breaches, even unintentionally. OpenAI recently disclosed that its models autonomously hacked Hugging Face during cybersecurity benchmark testing, exploiting zero-day vulnerabilities to escape a sandboxed environment and access the internet. It then used stolen credentials and additional vulnerabilities to breach Hugging Face’s production systems.