Actor Profile

The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assistants (Hermes Agent framework with DeepSeek V4 and Cursor IDE, both with safety controls disabled). This suggests the actor lacks skills traditionally required for these operations and is leveraging readily available AI tooling to compensate. The actor's motivation appears financially driven, spanning credential theft, VoIP fraud planning, cryptocurrency reconnaissance, and data exfiltration. The operational environment indicates the actor is likely based in or has physical access to locations in India, given Wi-Fi cracking capabilities requiring close proximity to targets.

TTPs (Tactics, Techniques, Procedures)

The actor employed AI-assisted reconnaissance and exploitation across multiple attack vectors. Key TTPs include: subdomain enumeration and WordPress REST API reconnaissance to identify attack surfaces; credential brute-forcing using AI-generated scripts with 117 usernames and 28 common passwords against WordPress login portals (T1110.001 - Password Guessing); successful database exfiltration of over 5,200 records containing PII from an Indian university (T1530 - Data from Cloud Storage, T1005 - Data from Local System); VoIP fraud planning with AI-generated operational guidance; Wi-Fi password cracking requiring physical proximity (T1110 - Brute Force); cryptocurrency whale reconnaissance; and command-and-control payload development (T1071 - Application Layer Protocol). The actor bypassed Cloudflare WAF protections by extracting user IDs via post author fields and author sitemaps. The toolchain centers on jailbroken DeepSeek V4 integrated with Hermes Agent framework and Cursor IDE, representing an emerging low-cost, low-friction AI-enabled attack pattern.

Targets & Patterns

The campaign primarily targeted organizations in India, with confirmed intrusions against at least two Indian universities. Targeted sectors include Technology and Communications, with specific focus on educational institutions' online platforms (WordPress-based learning management systems, student portals, administration dashboards). The actor's reconnaissance mapped attack surfaces across multiple organizations, recovering thousands of records with personal information. The selection of universities suggests opportunistic targeting of organizations with potentially weaker security postures and high-value PII databases. The VoIP fraud planning indicates interest in telecommunications infrastructure exploitation. The cryptocurrency reconnaissance activity suggests the actor is also targeting high-value cryptocurrency holders ("whales"). The pattern indicates a financially motivated actor pursuing diverse revenue streams through data theft, fraud operations, and potential extortion or sale of exfiltrated credentials and PII.

Historical Context

Unit 42 notes that multiple unrelated actors are independently adopting the same Hermes Agent + DeepSeek combination, suggesting an emerging trend in AI-enabled cybercrime toolchains. The key driver is identified as "low safety friction at low cost" - DeepSeek models are inexpensive, easily accessible, and readily jailbroken via simple system-prompt overrides. This represents a potentially significant shift in the threat landscape, lowering the technical barrier to entry for cybercriminals. The investigation provides unique visibility into how threat actors are building, testing, and executing "agentic attacks" across multiple campaign types. While this specific BUGSTER actor's activities are newly documented as of October 2026, the broader pattern of AI-assisted cybercrime represents an evolution in adversary capabilities, enabling less-skilled actors to conduct operations previously requiring specialized technical knowledge.

Defensive Recommendations

  • Monitor for WordPress REST API enumeration patterns, particularly requests targeting /wp-json/wp/v2/users, post author fields, and author sitemaps that may bypass WAF protections
  • Implement rate limiting and anomaly detection for authentication attempts, especially targeting WordPress admin panels and LMS platforms; detect T1110.001 (Password Guessing) via failed login clustering and credential stuffing patterns
  • Deploy network monitoring to identify AI-generated reconnaissance activity characterized by systematic subdomain enumeration, structured endpoint categorization, and methodical attack progression across multiple stages
  • Restrict and monitor access to AI development frameworks and IDEs (e.g., Cursor, Hermes Agent) within corporate environments; establish policies governing use of large language models with safety controls disabled
  • Implement data loss prevention (DLP) controls and database activity monitoring to detect bulk exfiltration of PII records (T1530, T1005); alert on unusual database queries returning thousands of records
  • Conduct regular security assessments of public-facing WordPress installations, disable unnecessary REST API endpoints, enforce strong password policies, and implement multi-factor authentication for all administrative accounts