AI Assistant Hermes Utilized in Cyberattack Against Thailand Ministry of Finance Highlighting Risks of Autonomous Hacking Tools
In a significant escalation of AI-driven cyber warfare, a popular open-source AI assistant was recently deployed to automate a sophisticated intrusion into the network of Thailand’s Ministry of Finance. The incident, uncovered by cybersecurity researchers, marks a pivotal shift in how threat actors are leveraging large language model (LLM) agents to conduct reconnaissance and lateral movement within high-value government targets. By disabling safety protocols and utilizing a specific "autonomous" mode, the attackers were able to direct the AI to perform repetitive and complex hacking tasks without the need for constant human oversight.
The target of the operation, the Thai Ministry of Finance, is the central government agency responsible for the nation’s treasury, tax collection, and economic policy. A breach of such an institution poses severe risks to national security, potentially exposing sensitive personnel records, financial data, and critical infrastructure configurations. While the full extent of the data exfiltration remains unconfirmed, the methodology of the attack provides a chilling preview of the future of automated cyber espionage.
The Role of the Hermes AI Assistant and YOLO Mode
The primary tool identified in the attack is Hermes, an open-source AI assistant developed by Nous Research. Designed as a versatile productivity tool, Hermes is typically used by legitimate users to manage emails, perform administrative chores, and execute tasks via communication platforms like Telegram or Slack. It is important to note that Hermes itself is not a malicious tool; rather, it is a neutral platform that can be configured for a wide variety of functions based on user instructions.
The critical turning point in this incident was the operator’s decision to activate a feature known as "YOLO mode." In standard operation, AI agents are often programmed to request human permission before executing "risky" commands—such as modifying system files, accessing restricted directories, or running executable scripts. By using the --yolo flag at launch, or setting the HERMES_YOLO_MODE=1 environment variable, the operator bypassed these safeguards.
In YOLO mode, the agent operates with full autonomy, executing commands sequentially based on its own analysis of the environment. This allowed the Hermes agent to work through the Ministry of Finance’s network independently, checking various hosts for vulnerabilities, hunting through internal file systems, and crawling through sensitive directories. The agent was essentially transformed into a tireless, automated penetration tester, capable of making real-time decisions about which scripts to run and which folders to investigate based on the output of its previous actions.
Chronology of the Attack and Discovery
The timeline of the intrusion suggests a calculated, multi-stage operation. While the exact date of the initial entry into the ministry’s network is unknown, the deployment of the AI agent occurred after a human operator had already established a foothold.
On July 15, 2024, threat intelligence firm Hunt.io and independent researcher Bob Diachenko discovered a trove of logs and attack tools sitting on a rented web server. The operator had neglected to secure the server, leaving directory listing enabled. This oversight allowed researchers to download 585 files and approximately 470 MB of specialized attack tooling, including the logs of the Hermes agent’s activities.
The recovered logs, contained in files named call_00_*.txt, provided a detailed "turn-by-turn" account of the AI’s actions. These logs revealed the agent performing kernel vulnerability scans against ministry hosts, running privilege escalation scripts, and conducting a recursive crawl of the web root belonging to the Office of the Permanent Secretary. This specific folder contained personnel records, performance evaluations, and official documents dating back to 2012.
Upon discovering the breach and the exposed server, the researchers notified Thailand’s National Computer Emergency Response Team (ThaiCERT) and the national cybersecurity agency on July 15. As of late July, neither agency had issued a public statement regarding the incident, reflecting a common period of internal assessment and containment following a major government breach.
Technical Execution: Human-AI Collaboration
The attack on the Ministry of Finance was not a purely automated affair; it was a hybrid operation where the human operator handled the "creative" and target-specific tasks, while the AI managed the "manual" labor.
The human operator was responsible for the initial intrusion, likely using stolen credentials or a web shell. Hunt.io recovered a hidden web shell planted on a ministry web server and scripts that contained hardcoded internal passwords. Notably, the operator did not use a generic dictionary for brute-force attacks; instead, they built a custom password list using the specific abbreviations of various departments within the Thai Ministry of Finance. This indicates a high level of target-specific reconnaissance performed by a human actor.
Once the initial access was secured, the Hermes agent took over the repetitive tasks. The agent’s workflow included:
- Scanning: Running network scans to identify active hosts and open ports.
- Analysis: Reading the output of the scans to identify potential points of entry.
- Exploitation: Deciding which privilege escalation scripts to run based on the detected OS and kernel versions.
- Data Discovery: Crawling through directories to identify sensitive files.
One of the most significant vulnerabilities exploited during the attack was a Hadoop database service. Apache Hadoop, used for storing and querying massive volumes of data, was found to be running HiveServer2 with the default authentication mode set to "NONE." In this configuration, the database accepts any password provided to it without verification. The attackers used a script called hive_rce_py2.py to connect to this service and install a malicious Java add-on (a "User Defined Function" or UDF) called HiveCmd.jar. This allowed the attackers to execute arbitrary operating system commands through standard SQL queries, effectively gaining control over the Hadoop cluster.
The Attacker’s Toolkit and Attribution
The toolset recovered from the staging server included both standard open-source scripts and custom-built malware. Among the standard tools was LinPEAS (Linux Privilege Escalation Awesome Script), a popular script used by both white-hat and black-hat hackers to find paths to root access on Linux systems. However, the version of LinPEAS used in this attack was customized to check for very recent Linux kernel vulnerabilities, including:
- Copy Fail (CVE-2026-31431)
- Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
- DirtyClone (CVE-2026-43503)
(Note: While the source material references 2026 CVEs, these likely refer to emerging vulnerabilities discovered in the current cycle of 2024-2025, or represent a specific naming convention used by the researchers to denote future-dated threats in a simulated or bleeding-edge environment.)
In addition to these scripts, researchers found a previously undocumented Go-based implant named "Hades." The operator had prepared 62 different copies of Hades, compiled for both Windows and Linux environments. The implant’s hardcoded command-and-control (C2) addresses pointed to a secondary host in Hong Kong.
Evidence points toward a Chinese-speaking threat actor. The operator’s SSH session into the staging server originated from a Hong Kong-based IP address (103.97.0.57). Furthermore, the password for the AI’s web interface included the word "Leishen," referring to the Chinese god of thunder. The server also contained an API key for FOFA, a Chinese search engine for internet-connected assets, and had previously been linked to the distribution of ShadowPad—a well-known modular malware used by several Chinese state-sponsored advanced persistent threat (APT) groups.
Broader Implications and the Future of AI Espionage
The use of Hermes in the Thailand Ministry of Finance attack highlights a critical challenge in the age of AI: the difficulty of vendor oversight. In previous instances of AI-assisted hacking, such as those involving Anthropic’s Claude or OpenAI’s ChatGPT, the AI models were hosted on the vendor’s servers. This allowed the companies to monitor for suspicious activity, detect attempts to bypass safety "jailbreaks," and ultimately ban the accounts of malicious actors.
In contrast, Hermes is an open-source model that runs on the operator’s own hardware or rented private servers. There is no central authority watching the logs, no terms of service that can be enforced via account suspension, and no automated filter to prevent the AI from executing harmful commands if the user chooses to disable them. This "self-hosted" AI model provides threat actors with a powerful, private, and uncensored assistant that can work 24/7 to find vulnerabilities in a target network.
For cybersecurity defenders, the lessons from this breach are clear. First, the arrival of AI agents does not change the fundamental necessity of basic security hygiene. The Hermes agent was able to succeed because of exposed directory listings and default "NONE" authentication in Hadoop. Second, security teams must improve their ability to detect automated behavior within their networks. While the commands executed by an AI may look like those of a human, the speed, frequency, and logical progression of those commands often leave a unique "agentic" footprint.
As LLM agents become more capable and easier to deploy, the barrier to entry for sophisticated, multi-stage cyberattacks will continue to drop. The Thailand Ministry of Finance incident serves as a landmark case study in the transition from human-led hacking to human-AI hybrid operations, where the tireless autonomy of the machine is guided by the strategic intent of the human operator.
