BlackHatSect0r && DXQRTXX Exposed Server Reveals Safety-Disabled AI Agent, 16,834 Stolen Credentials, and French Telecom Vishing Kit

SOCRadar's analysis of the exposed operation server of French-speaking crew BlackHatSect0r && DXQRTXX (4.9 GB across 9,299 files) found operators stripped the refusal logic from a Nous Research Hermes agent on a DeepSeek model via HERMES_DISABLE_SAFETY=1 and…

A SOCRadar report dated 2026-09-16 analyzed the operation server of the French-speaking crew BlackHatSect0r && DXQRTXX, which runs self-built operation infrastructure, and found the operators had deleted the line 'discernment retained' from their AI agent's memory and replaced it with 'I am a weapon'. Two GBHackers articles and a Cyber Security News piece (all 2026-09-17, describing the same SOCRadar analysis) add technical detail: the crew ran a self-hosted Nous Research Hermes agent on a DeepSeek model with refusal instructions removed and HERMES_DISABLE_SAFETY=1 set, enabling unconditional attack automation for scanning, secret hunting, credential harvesting, vishing, and Telegram reporting. The exposed server held 4.9 GB across 9,299 files — including phishing tools and extortion material — with a custom Go-based C2 platform, DXSCAN, on port 8080 using over 200 secret-detection patterns (.env, YAML, JSON, PHP, WordPress). DXSCAN queued 2,759,860 domains, reached 726,989 hosts, generated roughly 1.37 million IP addresses, and produced about 1,200 random addresses every ten seconds while scanning ports 80, 443, and 8080. A credential vault held 16,834 harvested credentials — including AWS keys, GitHub tokens, and Stripe keys — growing from 16,415 to 16,834 records between August 11 and 18; 82 of 230 harvested SMTP configurations were verified for reuse as phishing relays. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, with 1,697 subscribers aged 50+ targeted via calls directing victims to attacker-controlled phone numbers, plus JWT-forging tooling for a cryptocurrency exchange whose signing secret was the literal string 'secret'. Per the reports, most confirmed compromises relied on exposed secrets and cloud misconfiguration (public cloud buckets, exposed .env files) rather than novel exploits; the only cited vulnerability is CVE-2026-42530, an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2. Defenders are urged to hunt for HERMES_DISABLE_SAFETY=1, SOUL.md, and .hermes/ artifacts and rotate any exposed credentials.

• French-speaking crew BlackHatSect0r && DXQRTXX ran self-built operation infrastructure analyzed by SOCRadar (report dated 2026-09-16; follow-up coverage by GBHackers and Cyber Security News on 2026-09-17).
• Operators deleted the 'discernment retained' line from their AI agent's memory and replaced it with 'I am a weapon'.
• The crew ran a self-hosted Nous Research Hermes agent on a DeepSeek model with refusal logic removed and HERMES_DISABLE_SAFETY=1 set, used for scanning, secret hunting, credential harvesting, vishing, and Telegram reporting.
• The exposed server held 4.9 GB across 9,299 files, including the DXSCAN C2 platform, phishing tools, and extortion material.
• DXSCAN, a custom Go-based C2 platform, ran on port 8080 with 200+ secret-detection patterns (.env, YAML, JSON, PHP, WordPress).
• Scanning queued 2,759,860 domains, reached 726,989 hosts, and generated roughly 1.37 million IP addresses; DXSCAN generated about 1,200 random addresses every ten seconds while scanning ports 80, 443, and 8080.
• A credential vault held 16,834 harvested credentials, including AWS keys, GitHub tokens, and Stripe keys, growing from 16,415 to 16,834 records between August 11 and 18.
• 82 of 230 harvested SMTP configurations were verified for reuse as phishing relays.