BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials

BlackHatSect0r && DXQRTXX has been linked to an automated cybercrime operation that used an AI agent connected to a DeepSeek model to scan for exposed secrets, test stolen access, and feed results into a custom control platform.

The activity shows how common security gaps can be abused at machine speed.An exposed operation server contained 4.9 GB of material across 9,299 files, including the DXSCAN platform, phishing tools, extortion material and a vault with 16,834 credentials.

The crew queued 2,759,860 domains, reached 726,989 hosts and generated 1,374,300 IP addresses during its campaign.

SOCRadar researchers identified the infrastructure and found evidence that the French-speaking crew removed safeguards from its agent before using it across multiple campaigns.

SOCRadar said in a report shared with Cyber Security News (CSN) that the operation relied on exposed cloud storage, readable configuration files and weak secrets, rather than new vulnerabilities.

The impact extends beyond credential theft. The material links the group to alleged public-sector data theft, extortion claims, a cryptocurrency exchange data exposure and bank-impersonation calls aimed at older people.

The case adds urgency to AI agent attack automation because automation can make routine misconfigurations far more damaging.

BlackHatSect0r Uses DeepSeek-Powered AI Agent

The group ran a Nous Research Hermes agent against a DeepSeek model, controlled through a 14 KB identity file called SOUL.md.

The operator removed the agent’s refusal memory, disabled safety settings and set seven background workers to keep scanning, collecting and reporting without constant human input.

DXSCAN generated roughly 1,200 random addresses every ten seconds, checked ports 80, 443 and 8080, identified web software, and searched for more than 200 credential patterns.

When it found exposed .env files, cloud keys or database details, it stored the data and sent French-language victim reports through Telegram.

That workflow illustrates the concern raised in recent reporting on autonomous credential theft campaigns: AI did not need to invent a breakthrough exploit to cause harm.

It gave the operators persistence, speed and the ability to run reconnaissance, validation and collection in parallel. The crew marketed some tools as zero-days, but the research found no confirmed breach based on a new flaw.

Confirmed access came from public cloud buckets, exposed .env or Git files, default signing keys, or secrets placed in browser code. In one exchange case, a JWT signing secret set to “secret” exposed 418 identity records.

Exposure Gaps Fuel Credential Theft

The credential vault grew from 16,415 records on August 11 to 16,834 by August 18. It included generic secrets, database and SMTP credentials, API keys, AWS keys, GitHub tokens and Stripe keys. Of 230 SMTP configurations, 82 were verified and prepared for possible reuse as phishing relays.

The same infrastructure supported phishing that encouraged recipients to telephone an attacker-controlled number instead of clicking a harmful link.

That tactic can avoid link scanning and attachment checks, making staff awareness and call-back procedures essential. Readers tracking related threats can review AI enabled cyberattack techniques for context on how agents divide work across an intrusion.

Organizations should audit cloud storage for public read or write access, remove .env, .git, debug and actuator endpoints from the internet, and rotate every secret that may have been exposed.

Signing keys and token-generation material should remain on the server, while default or easy-to-guess values must be replaced immediately.

Defenders should also hunt for the listed infrastructure, unusual GHOST strings, SOUL.md, .hermes directories and unauthorized ngrok activity.

Web teams can flag short bursts of requests for configuration paths from one source, particularly when they follow scans of common web ports.

These checks reinforce the lessons from exposed Vite server attacks, where accessible environment files can open the door to broader compromise.

Security teams should investigate matching indicators, isolate systems, preserve logs, and review authentication activity promptly.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 server	217.156.122[.]129	Active DXSCAN C2 node hosted in Moldova
C2 server	37.221.66[.]43	Retired DXSCAN C2 node hosted in Moldova
Network ports	8080, 3480, 9998, 9999, 4444	C2/API, dashboard, hub and reverse-shell related ports
Telegram bot ID	8719074836	@FicheCallSGBot
Telegram bot ID	8991452393	@HackAUreBOT
Telegram bot ID	8924646821	Telegram-related infrastructure identifier
Telegram chat ID	-5489653213	Destination for automated victim reports
Cryptocurrency wallet	bc1qg6m4733jazxca5ftc7aggdmsflwdwzlm	Bitcoin wallet embedded in the actor’s tooling
Host artifacts	SOUL.md; .hermes/; HERMES_DISABLE_SAFETY=1	AI-agent framework artifacts and disabled safety setting
Credential marker	GHOST-VAULT-	Prefix used in credential IDs
User-agent and tool strings	GHOST-CRED/3.0; GHOST-VAULT/; GHOST/0day	Distinctive strings for log and endpoint hunting
Process naming	ghost_	Prefix associated with agent-related process names
Tunneling service	ngrok	Used to expose cloned phishing pages
File names	env.4.2.0.js; main-NDOQMLR2.js	Reverse-engineered client-side bundles
Phishing phone number	+33 1 89 62 92 59	Attacker-controlled number used in bank-impersonation calls
SHA-256	48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf	DXSCAN compiled C2 build
SHA-256	0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5	DXSCAN debug build
SHA-256	92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f	Related compiled C2 build
SHA-256	8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3	DXSCAN backup build
SHA-256	8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9	DXSCAN backup build
SHA-256	db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0	Newer compiled C2 build
SHA-256	c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8	Previous compiled C2 build
Weaponized CVEs	CVE-2021-3129; CVE-2018-15133; CVE-2022-22947; CVE-2021-29447; CVE-2026-42530	Vulnerabilities and public proof-of-concept code referenced in the toolset

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC