A threat actor allegedly utilized the open-source Hermes AI agent in an unattended "YOLO" mode to automate post-exploitation activities during a purported breach of Thailand's Ministry of Finance. This activity was uncovered by the threat intelligence firm Hunt.io and security researcher Bob Diachenko, who identified several exposed web directories containing files related to the operation. While Hunt.io suggests that session files, deployed web shells, and evidence of internal system access indicate a compromise of multiple systems within the ministry's network, the Ministry of Finance has not confirmed any breach. Some recovered artifacts reportedly show systems were targeted rather than successfully compromised.
Between July 9 and July 13, Hunt.io discovered three publicly accessible directories on a Hong Kong-hosted server. These directories contained 585 files, totaling approximately 470 MB, which included exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent. The files explicitly referenced Ministry of Finance systems by name, hostname, and internal IP address. Scripts found targeted the ministry's Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts attempted authentication against ministry mail servers using embedded email addresses and passwords.
A PHP web shell, believed to have been deployed on a Ministry of Finance web server, was also found. Researchers linked the initial server to additional attacker-controlled infrastructure through shared TLS certificates used during the same period. These certificates shared a JA4X fingerprint, a hash derived from the certificate's structure. Querying this hash alongside the common name revealed two additional related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong). One of these servers was later connected to the operation via a command-and-control address embedded in a recovered implant.
The exposed directories also contained Windows and Linux builds of a previously undocumented Go-based implant, which the operator named Hades. However, the most notable discovery was a collection of logs indicating the use of the Hermes AI agent to automate parts of the cyberattack. Hermes, an open-source AI agent released in February 2026, operates as a persistent service and can retain information across task sessions. It interacts with tools and executes commands based on operator-provided tasks.
The "YOLO" mode setting in Hermes disables prompts that would require human approval for potentially dangerous commands. Recovered environment information and Hermes output logs from the exposed directories confirmed that this unattended mode was enabled. This allowed the agent to execute commands and continue system analysis without requiring human approval at each step. Five recovered Hermes call logs showed the agent was used for tasks such as privilege escalation, scanning for kernel vulnerabilities, enumerating services, searching for SUID and SGID binaries, inspecting containers, and traversing file systems.
Hermes was also instructed to use a customized version of the LinPEAS privilege-escalation enumeration script to gather information from a Ministry of Finance host. In another task, the operator directed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance. The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. However, Hunt.io stated that there was no evidence these files were exfiltrated.
The findings indicate that Hermes did not independently decide to target the ministry. Instead, the exposed logs show an operator supplying the agent with objectives and tools, with YOLO mode enabling it to perform routine post-exploitation commands autonomously. Hunt.io believes the recovered artifacts suggest an active intrusion where tools were staged and access to internal systems was expanding. The researchers could not determine the initial access vector. Hunt.io and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15, with both organizations acknowledging receipt of the notification on the same day.
