Attacker used DeepSeek to steal 5,200 Indian university records
Original title: Hacker With Limited Skills Used DeepSeek AI to Breach Indian University and Steal Over 5,200 Records
Unit 42 says a weak administrator password, not a new software flaw, exposed the MongoDB holding student and staff data.
Unit 42 said an operator using the handle BUGSTER combined Hermes Agent, DeepSeek V4 and Cursor while attacking Indian organizations, including two unnamed universities. In one intrusion the attacker used an administrator account with a weak password to copy a MongoDB database holding more than 5,200 student and staff records. Investigators also found credential scanning, Wi-Fi cracking and phone-fraud planning that had not become active. Unit 42 said the model did not carry out the activity by itself.
Unconfirmed: Universities were not named, and Unit 42 did not link the WordPress login to the stolen database.
- The 5,200-record theft was separate from a WordPress password-guessing case.
- Records covered diploma through postgraduate students and faculty.
- Infrastructure IoCs are 162.243.3[.]92 and proxy 104.238.38[.]202.
- Unit 42 found no call records showing planned VoIP fraud was active.
- Wi-Fi cracking required a nearby device to collect authentication data.
Impact: More than 5,200 student and staff records stolen
- 1.Remove weak or reused administrator passwords and require multi-factor authentication.
- 2.Limit database access and check internet-facing portals for unnecessary exposure.
- 3.Revoke or rotate secrets that may have been exposed in files or logs.
- ATT&CK
- T1110.001 Password GuessingT1078 Valid AccountsT1552.001 Credentials In FilesT1040 Network Sniffing
- Products
- Hermes AgentCursor
- Organizations
- Unit 42Palo Alto Networks
- Countries
- India
- AI models
- DeepSeek V4
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.238.38.202 | tor infrastructure used to host several services IP address 104.238.38[.]202 Commercial proxy server Note: IP addresses and domains ar |
| ipv4 | 162.243.3.92 | rs of compromise (IoCs):- Type Indicator Context IP address 162.243.3[.]92 Actor infrastructure used to host several services IP add |
From the original article
4 min read at cybersecuritynews.com
A cybercriminal using the online handle BUGSTER used artificial intelligence tools to support attacks on Indian organizations, including two universities. In one confirmed intrusion, the attacker stole a MongoDB database containing more than 5,200 records, including personal information about students and staff, according to Palo Alto Networks’ Unit 42. The researchers did not name the […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.