Researchers from cybersecurity firm Hunt.io have reported a cyber-espionage campaign targeting Thailand’s Ministry of Finance, allegedly conducted using an autonomous artificial intelligence agent. The investigation revealed a hacker-controlled server that exposed various files, including malware and stolen credentials, while the attack was still ongoing. This incident highlights the evolving threat landscape where AI technologies are being weaponized for cyber operations.
Details of the Cyber-Espionage Campaign
The exposed files included attack scripts, AI agent logs, and evidence of unauthorized access to multiple systems within the Ministry of Finance. However, the initial breach method remains undetermined. The operation was largely orchestrated by an open-source AI agent named Hermes, developed by Nous Research, which was configured to execute commands autonomously.
Malware and Exploits Identified
The infrastructure compromised by the attackers contained exploits for known software vulnerabilities, tailored scripts for the ministry, and a new malware family identified as Hades. This malware functions as a backdoor, allowing persistent access to the compromised systems. Hunt.io discovered both Windows and Linux versions capable of executing commands remotely and transferring files.
Target Identification and Response
Researchers identified the Ministry of Finance as the likely target due to specific references in the recovered scripts to the agency’s internal systems, including administrative portals and email systems. Although evidence of system compromise was found, there was no indication of data exfiltration. The focus appeared to be on reconnaissance and credential theft.
Thailand’s national computer emergency response team, ThaiCERT, and the National Cyber Security Agency were notified of the incident on July 15, with malicious activity traced back to mid-to-late June. Thai cybersecurity officials have announced plans to enhance defenses against AI-driven cyber threats, emphasizing the need to balance AI benefits with risk management.
For further details, refer to the report by The Record.
