Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand’s Ministry of Finance, which runs the country’s treasury and tax collection.
The agent then worked through the ministry’s network on its own, checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records going back to 2012.
The operator left the agent’s own logs sitting on a web server with directory listing switched on, where threat intelligence firm Hunt.io and researcher Bob Diachenko found them, along with 585 files and 470 MB of attack tooling.
The tool is Hermes, an open-source assistant from Nous Research that people install to manage their mail, run chores, and take instructions over Telegram or Slack. It is not a hacking tool, and nothing here is a flaw in it.
The mode the operator used, called YOLO, is a documented feature with its own command-line flag. That is what separates this case from the AI-assisted attacks reported so far.
When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to trick the model into cooperating, and Anthropic banned their accounts once it noticed. Hermes runs on the operator’s own machine. No vendor was watching, and there was no account to ban.
The operator was already inside before the agent started. Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script.
Nothing in the recovered files shows data leaving the network, and how the operator first got in is unknown. Thailand’s national CERT and cybersecurity agency were notified on July 15; neither had published anything when The Hacker News checked on July 24.
For everyone else, the useful detail is what the operator’s scripts were built to exploit: a Hadoop database service that ships accepting any password by default.
The human did the parts that require knowing the target. Hunt.io’s writeup shows a password list built from the ministry’s own department abbreviations rather than a dictionary, and shellcode carrying hardcoded paths into the ministry intranet.
The agent did the repetitive part: run a scan, read the output, decide what to check next, run another. Nothing in the recovered material shows it finding a new vulnerability or choosing the target.
None of the commands were exotic. LinPEAS, a standard script that hunts for privilege escalation paths on Linux. A search for files carrying elevated permissions. A directory crawl. A person would type the same things. What changed is that nobody had to approve each one.
Hermes offers that setting three ways: a –yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable. The project’s configuration guide says to “only use this in trusted, sandboxed environments.”
One layer survives it: a hardline blocklist that still refuses commands which would wipe the machine the agent is running on. What the operator switched off was the human check, not every safeguard.
What the agent did
Five files named call_00_*.txt hold the agent’s turns: kernel vulnerability scanning against a ministry host, a second LinPEAS run, a sweep for elevated-permission binaries, a filesystem listing, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary.
That folder held Office documents, performance evaluations, and personnel records dating to 2012. The logs show the agent reading the directory. None of them show the files leaving it.
The scan script it was handed was not stock. A customized linpeas.sh checked for four 2026 Linux kernel flaws across three families: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503).
Each hands a local user root where its prerequisites hold, which for Dirty Frag and DirtyClone means CAP_NET_ADMIN. All were weeks old when the operator staged them, and nothing recovered names a ministry kernel version or shows that any of the four ran.
The operator’s own SSH session into the staging server came from 103.97.0[.]57 in Hong Kong. The agent’s web interface password contains the Chinese word Leishen, thunder god, and a key for FOFA, a Chinese asset-search service, sits alongside it.
The same server previously hosted a ShadowPad controller and now runs a VShell command-and-control listener. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language, and names no group. The firm and Diachenko remain the only public source for the ministry-specific findings.
The route into Hadoop
Most of the custom code went on the ministry’s Hadoop cluster, where it stores and queries large volumes of data. A script called hive_rce_py2.py connects to HiveServer2, the SQL front end to that cluster, on an internal machine at port 10000, and sends a password.
Apache’s own documentation says the default authentication mode is NONE, which accepts whatever password it is given without checking it.
Once connected, the script installs a malicious Java add-on called HiveCmd.jar as a user-defined function, which lets it run operating-system commands through ordinary database queries and read the results back. Cloudera warns that anyone able to install such a function can run arbitrary code as the Hive service account and reach sensitive data.
Also staged on the server: a previously undocumented Go implant the operator calls Hades, built for both Windows and Linux in 62 copies. Hunt.io analyzed one of each and found the same codebase; the other 60 were not examined individually.
Their hardcoded addresses tie the staging server to a second Hong Kong host, though no recovered artifact shows Hades reaching a ministry machine. Separate scripts tested default credentials against an internal GlassFish console, with neither deployment confirmed, alongside exploit code for three older flaws in polkit, sudo, and IIS 6.0.
What to do
- Check whether HiveServer2 is running with authentication set to NONE, and restrict who can install user-defined functions. That default is what the operator’s script was written to rely on.
- Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070. A web server reaching a Hadoop node is worth a look on its own.
- Search web roots recursively for PHP files with leading-dot names that imitate system caches. This one sat at /storage/Counter/nine/.journald-cache.php and does not appear in a normal directory listing.
- Patch kernels against all four 2026 flaws above, plus sudo to 1.9.5p2 or later, polkit for CVE-2021-4034, and any remaining IIS 6.0 WebDAV.
The agent leaves its own trail. Hermes’s web panel returns a HermesWebUI server header, and a search on that string returned roughly 5,900 scan events over a month, as of Hunt.io’s July 23 report, counting sightings rather than distinct machines.
The better hook is where the agent writes its results: a consistent /hermes-results/ folder with predictable filenames, which turned up 575 hits in Hunt.io’s index of exposed directories the same day, each one a host and filename pair. No safety control exposed this operator. A directory listing did.
The endpoint sees the same shell commands and the same tools either way. Nothing in an ordinary command line announces that nobody is at the keyboard.
