BUGSTER used jailbroken DeepSeek to steal university PII
October 23: GBHackers, citing Unit 42, added Telegram-controlled profiles, two infrastructure addresses, and tests of other models.
Unit 42 says BUGSTER used Hermes and jailbroken DeepSeek V4 to breach Indian universities and steal more than 5,200 PII records.
Unit 42 says an actor using the handle BUGSTER ran the Hermes Agent framework with DeepSeek V4 and Cursor after disabling or overriding safety controls, and controlled profiles over Telegram. The actor brute-forced an Indian university WordPress site and used a weak administrator password to exfiltrate a MongoDB database from a second public university, including more than 5,200 student and faculty PII records. The same environment was used to plan VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control, and to build secret scanners and a reverse-shell listener. Unit 42 found no call logs or active VoIP routing and says other actors are independently adopting Hermes with DeepSeek.
- Enumeration found 12 subdomains and 13 WordPress user accounts.
- A generated tool tried 117 usernames and 28 common passwords.
- Listed infrastructure includes 162.243.3.92 and proxy 104.238.38.202.
- Wi-Fi cracking required physical proximity, according to Unit 42.
- VoIP work was planning only; Unit 42 found no call logs or routing.
- The actor tested other models and used prompt overrides to weaken limits.
What each outlet adds
beyond the shared facts- Palo Alto Unit 42Cursor use, Cloudflare, Wi-Fi proximity, and other actors adopting Hermes.
- GBHackersTelegram control, two IP addresses, and tests of other models.
- Threat actors
- BUGSTER
- Organizations
- Unit 42Palo Alto Networks
- Countries
- India
- AI models
- DeepSeek V4
Coverage
oldest first · one row per article · UTC- · 4d ago
Palo Alto Unit 42First report
BUGSTER used jailbroken AI to hit Indian universities, Unit 42 says
The actor dumped more than 5,200 student records and planned VoIP fraud, Wi-Fi cracking, and crypto reconnaissance.
- · 2d ago
GBHackers
Unit 42: BUGSTER used DeepSeek V4 in India university data theft
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.