Unit 42: BUGSTER used DeepSeek V4 in India university data theft
Original title: Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.
Unit 42 says a threat actor using the handle BUGSTER ran the Hermes Agent framework with DeepSeek V4 and controlled profiles over Telegram. The operation targeted organizations in India, including universities. AI-generated reconnaissance and a password-guessing tool led to a valid login, and a separate weak administrator password was used to exfiltrate a MongoDB database. VoIP fraud discussions showed planning only; Unit 42 found no call logs or active routing.
Unconfirmed: Unit 42 attributes the activity to BUGSTER; the VoIP fraud operation is not confirmed.
- Reports mapped 12 subdomains, and WordPress REST API data identified 13 accounts.
- A guessing tool used 117 usernames and 28 common passwords.
- Unit 42 also found secret scanners, a reverse-shell listener, and a Wi-Fi cracking pipeline.
- Listed infrastructure includes 162.243.3.92 and proxy 104.238.38.202.
- The actor also tested other models and used prompt overrides to weaken safety limits.
Impact: theft of more than 5,200 student and faculty PII records
- 1.Hunt logs for infrastructure 162.243.3.92 and 104.238.38.202.
- Threat actors
- BUGSTER
- Organizations
- Unit 42Palo Alto Networks
- Countries
- India
- AI models
- DeepSeek V4
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.238.38.202 | Description 162.243.3[.]92 IPv4 Threat actor infrastructure 104.238.38[.]202 IPv4 Commercial proxy server Note: IP addresses and domai |
| ipv4 | 162.243.3.92 | parts of cyber operations. IOCs IP Address Type Description 162.243.3[.]92 IPv4 Threat actor infrastructure 104.238.38[.]202 IPv4 Co |
From the original article
3 min read at gbhackers.com
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200 […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.