BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials
SOCRadar linked the BlackHatSect0r crew to a DeepSeek-powered AI agent that automated scanning and harvested 16,834 credentials from exposed systems.
SOCRadar researchers found an exposed operation server with 4.9 GB across 9,299 files, including the DXSCAN scanning platform, phishing tools, extortion material and a vault holding 16,834 credentials such as AWS keys, GitHub tokens and Stripe keys. The French-speaking crew ran a Nous Research Hermes agent against a DeepSeek model with safety features removed, queuing 2,759,860 domains and reaching 726,989 hosts. Access came from misconfigurations like public cloud buckets and exposed .env files, not new vulnerabilities.
- Credential vault grew from 16,415 to 16,834 records between August 11 and 18
- DXSCAN generated roughly 1,200 random addresses every ten seconds scanning ports 80, 443, 8080
- 82 of 230 harvested SMTP configurations verified for reuse as phishing relays
- Agent's refusal memory removed and safety settings disabled via HERMES_DISABLE_SAFETY=1
- Bank-impersonation vishing calls directed victims to attacker-controlled phone numbers
- ATT&CK
- T1595.002 Vulnerability ScanningT1552.001 Credentials In FilesT1078 Valid AccountsT1656 Impersonation
- Vendors
- SOCRadarNous Research
- Products
- DXSCAN
- Threat actors
- BlackHatSect0rDXQRTXX
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 217.156.122.129 | of compromise (IoCs):- Type Indicator Description C2 server 217.156.122[.]129 Active DXSCAN C2 node hosted in Moldova C2 server 37.221. |
| ipv4 | 37.221.66.43 | 122[.]129 Active DXSCAN C2 node hosted in Moldova C2 server 37.221.66[.]43 Retired DXSCAN C2 node hosted in Moldova Network ports 80 |
| sha256 | 0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5 | db5f801194896f50896761ebdf DXSCAN compiled C2 build SHA-256 0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5 DXSCAN debug build SHA-256 92dc24c9abc5baf7f2924c1872b14e74 |
| sha256 | 48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf | -controlled number used in bank-impersonation calls SHA-256 48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf DXSCAN compiled C2 build SHA-256 0e134b72aad30d938043df8f2d |
| sha256 | 8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3 | 869ad159ec5d119a3aa02ca1f Related compiled C2 build SHA-256 8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3 DXSCAN backup build SHA-256 8c12f1b013f6d68121b76f4ef65c294 |
| sha256 | 8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9 | 27e40ab6ea3a902080be526155380c3 DXSCAN backup build SHA-256 8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9 DXSCAN backup build SHA-256 db94077fcbcf030acff05334c5c0d15 |
| sha256 | 92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f | b4c57399a27311759a9e88f4c41c19e5 DXSCAN debug build SHA-256 92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f Related compiled C2 build SHA-256 8082a62e976c513605fd1d6b0 |
| sha256 | c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8 | af24f6c5747c3600652e9baf4c0 Newer compiled C2 build SHA-256 c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8 Previous compiled C2 build Weaponized CVEs CVE-2021-3129 ; |
| sha256 | db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0 | 3ab69151502d07ebef85994d656e5c9 DXSCAN backup build SHA-256 db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0 Newer compiled C2 build SHA-256 c0bb940a65ed234d0250edc8c4c |
From the original article
4 min read at cybersecuritynews.com
BlackHatSect0r && DXQRTXX has been linked to an automated cybercrime operation that used an AI agent connected to a DeepSeek model to scan for exposed secrets, test stolen access, and feed results into a custom control platform. The activity shows how common security gaps can be abused at machine speed. An exposed operation server contained 4.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.