BUGSTER used jailbroken AI to hit Indian universities, Unit 42 says
Original title: “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
The actor dumped more than 5,200 student records and planned VoIP fraud, Wi-Fi cracking, and crypto reconnaissance.
Unit 42 says an actor using the handle BUGSTER ran the Hermes Agent framework with DeepSeek V4 and Cursor, both with safety controls disabled. The actor brute-forced an Indian university WordPress site and exfiltrated a MongoDB database from a second public university, including student and faculty PII. The same environment was used to plan VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control. Unit 42 says other actors are independently adopting the Hermes and DeepSeek combination.
Unconfirmed: Impact and tooling details come from Unit 42's review of the actor's environment.
- Enumeration found 12 subdomains and 13 WordPress user IDs despite Cloudflare.
- A generated tool tried 117 usernames and 28 common passwords.
- An administrator account with a weak password was used in the database dump.
- Wi-Fi cracking required physical proximity, implying local access.
- Unit 42 says DeepSeek models are inexpensive and easy to jailbreak.
Impact: Student and faculty PII taken from a university database
- Products
- Hermes AgentCursorWordPress
- Threat actors
- BUGSTER
- Organizations
- Unit 42
- Countries
- India
- AI models
- DeepSeek V4
From the original article
12 min read at unit42.paloaltonetworks.com
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.