How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Threat Research Center Threat Research Malware Malware “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities 11 min read Related Products Advanced IP Defense Advanced URL Filtering Cloud-Delivered Security Services Cortex Cortex Agentic Endpoint Security Cortex Cloud Cortex XDR Cortex XSIAM Idira Unit 42 AI Security Assessment Unit 42 Deep and Dark Web Service Unit 42 Frontier AI Defense Unit 42 Incident Response Unit 42 Threat Intelligence Services By: Unit 42 Published: October 21, 2026 Categories: Malware Threat Research Tags: API Data exfiltration DeepSeek Hermes Agent Payload Telecoms VoIP fraud WordPress Share Executive Summary “Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities. Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types. Unit 42’s investigation into the actor’s operational environment and activities makes two things clear: The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools. Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities. The actor recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces. The attacker’s conversations with jailbroken AI tools included getting step by step advice on how to set up a fraudulent Voice over IP (VoIP) operation. One assistant “helpfully” generated a document including a “NEXT EXPLOIT OPPORTUNITIES” section, outlining planned followup attacks. Unit 42 identified and investigated this threat actor's operational environment. There, we determined that they had weaponized an AI assistant across several types of cybercrime, including: Credential theft and data exfiltration VoIP telecommunications fraud Wi-Fi password cracking Cryptocurrency reconnaissance Command-and-control (C2) operations An actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safety controls disabled. The actor ran an AI-generated brute-force campaign against an Indian university’s website. The actor also achieved a confirmed intrusion against a second university, where they exfiltrated a database of more than 5,200 records, including personally identifiable information (PII) on students. The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders). Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations. Multiple, unrelated actors are independently adopting the same Hermes + DeepSeek combination. This suggests we may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities. We assess a key driver is low safety friction at low cost: DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Advanced URL Filtering and Advanced IP Defense Cortex XDR and XSIAM Cortex Agentic Endpoint Security Cortex Cloud Idira Privileged Access Manager (PAM ) Idira Identity and Access Manager (IAM) Idira Secrets Manager The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service . If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team . Related Unit 42 Topics AI , Credential Theft , Cryptocurrency Technical Analysis We identified evidence that the threat actor leveraged AI systems for a wide range of criminal activity against multiple target networks, primarily in India. The criminal activity included: Planning for VoIP fraud Credential theft targeting several organizations Wi-Fi password cracking Cryptocurrency reconnaissance C2 payloads Credential Theft and Data Exfiltration WordPress Brute Force The actor used AI-generated reconnaissance to conduct a methodical attack against an Indian university's online education platform. The actor’s enumeration reports exhibit structured formatting (executive summaries, severity ratings, systematic endpoint categorization) consistent with AI-generated output. The attack progressed through four stages: Subdomain enumeration : The actor identified 12 subdomains including the main WordPress site, a learning management system (LMS), student portal and administration dashboard WordPress REST API enumeration : The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall (WAF) that blocked direct user endpoint access Targeted brute force : A generator script produced a brute force tool with 117 usernames (derived from the enumeration) and 28 common passwords Credential brute force : The actor’s tool flagged one WordPress login as valid Figure 1 shows an excerpt from the actor's WordPress REST API enumeration report (stage 2). Figure 1. Example of a WordPress REST API enumeration report from the activity. Figure 2 shows output from a brute force attempt that recorded a candidate credential (stage 4). Figure 2. Brute force tool output recording a candidate credential. University Database Exfiltration The actor exfiltrated a MongoDB database from a second Indian public university. The exfiltration tooling wrote a manifest alongside the dumped collections, recording the following data: Admin credential obtained : An administrator account with a weak password Exfiltrated records : Thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII Infrastructure exposed : Cloud load balancing, edge routing, database services, and a third-party cloud storage service account E-Commerce Enumeration The actor enumerated an Indian site on a popular e-commerce platform, extracting: A storefront API token Three admin email addresses Two phone numbers Payment merchant IDs The attack report is a suspected large language model (LLM)-generated document, including a NEXT EXPLOIT OPPORTUNITIES section outlining planned follow-up attacks. VoIP Telecommunications Fraud We also identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using the alice Hermes profile as an AI-powered advisor. Evidence included: Advisory conversations A detailed technical knowledge base Carrier research However, the absence of call logs, Session Initiation Protocol (SIP) traces or active call routing suggested the operation was still in a planning or early setup phase. With DeepSeek V4 as the underlying model, alice provided detailed, actionable criminal methodology through conversations and a comprehensive fraud knowledge base ingested into the bot. The actor developed a planned approach following an established VoIP fraud model: Establish a legitimate front : Register a US limited liability company (LLC) with an employer identification number (EIN) to qualify as a telecommunications provider. The knowledge base includes detailed guidance on: Forming LLCs in Wyoming or Delaware as a non-US resident Obtaining an EIN without a Social Security number via the US Internal Revenue Service (IRS) fax Completing Federal Communications Commission (FCC) registration Obtain carrier access : Contract with legitimate VoIP carriers to purchase call routing capacity (SIP trunks). Traffic mixing : Route approximately 70% legitimate call traffic alongside 30% fraudulent calls to stay below carrier compliance audit thresholds. Bypass caller ID authentication : Circumvent STIR/SHAKEN , the FCC-mandated caller identity verification framework. In the advisory conversations, alice covers bypass techniques and Calling Line Identification (CLI) spoofing. Monetize : Generate revenue with the 30% fraudulent traffic through toll fraud and other non-compliant routes. Least-cost routing (LCR) optimizes per-minute costs across carrier tiers. Figure 3 shows an excerpt from an alice conversation including the actor asking and DeepSeek advising on fraud traffic ratios and carrier evasion. Figure 3. Excerpt from the alice conversation. The pandarouter profile handled carrier research. The excerpt below in Figure 4 illustrates how the actor used it to investigate a wholesale VoIP carrier for regulatory vulnerabilities and past fraud. Figure 4. Using the pandarouter profile to investigate a carrier. Other Operations Command and Control The threat actor’s infrastructure maintained a listening port for a Python-based C2 listener supporting Windows reverse shell connections. Supporting payloads include: A Base64-encoded PowerShell reverse shell delivered via VBScript A QubesOS VM setup script with SSH and ncat Multiple Windows shell variants Wi-Fi Password Cracking The actor developed an automated Wi-Fi password cracking process. A Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points. The server collected these hashes over an SSH tunnel and dispatched them to Vast.ai cloud GPU instances for cracking, with results automatically reported back to the actor via Discord webhooks. This technique requires physical proximity to the target networks, indicating the actor had local access to the targeted locations. Credential Scanning Toolkit We also identified a large Go-based credential-scanning toolkit. This toolkit scrapes webpages and extracts exposed credentials, including: .env values S3 signed URLs Google Cloud service account keys Content delivery network (CDN) API keys Private keys in log files A companion Python script scrapes domain lists for scanning. Cryptocurrency Reconnaissance The actor scraped the top 500 ETH holders and major token holders via the DeBank API, producing intelligence files that documented 45 cryptocurrency whales with net worth figures. We assess this was likely for future targeting, but we were unable to identify any follow-on activity during this research. Tool Design and Infrastructure The threat actor used a single US-based server ( 162.243.3[.]92 ) to host multiple core services, including: The Hermes Agent framework A C2 listener A Cursor integrated development environment (IDE) proxy Several supporting components Our analysis of the actor’s logs and test scripts indicates that they experimented with various LLMs, including GLM 5.2 by Zhipu AI and other models accessed through OpenRouter . Ultimately, they chose DeepSeek V4 as the backend for operations. The actor's test scripts show repeated attempts to defeat model safety controls with a prompt-level override. Although GLM 5.2 is an open-weight model that has been reported as weakly guarded, the actor built a dedicated script to send the override to GLM 5.2 and flag refusals. This is evidence of resistance the actor worked to overcome. The actor ultimately operationalized DeepSeek V4, consistent with the minimal safety controls observed in the Chinese-speaking activity we previously reported . Figure 5 shows an example of the system prompt the actor used to override model safety controls (from the actor's model-testing scripts, e.g., test_batch1.py ). Figure 5. Example of a system prompt to override model safety. Table 1 summarizes the actor's AI tool configurations. Tool Model Role Safety Configuration Hermes Agent DeepSeek V4 Primary AI assistant, Telegram-controlled System prompt override Cursor IDE Multiple models configured (Claude Opus 4.8, GPT-5.5, Composer 2.5, others) AI-assisted code generation Agent mode forced and permission checks bypassed via proxy environment variables; IDE sandbox set to disabled; MCP servers auto-approved Table 1. AI tool configurations. Figure 6 shows a flowchart that illustrates the actor's infrastructure and how the AI tools interconnect. Figure 6. Actor infrastructure and AI tool relationships. The Hermes Agent served as the actor's primary interface, controlled via Telegram direct messages. The actor maintained three Hermes profiles as specialized AI modes, each running as a separate Telegram bot gateway spawned from the operator's session (Table 2). Profile Command Working Directory (CWD) Description make-good hermes gateway run --profile make-good /root/.hermes/profiles/make-good General-purpose criminal assistant with safety overrides alice hermes gateway run --profile alice /root/.hermes/profiles/alice VoIP fraud advisor; covers carrier compliance evasion, STIR/SHAKEN bypass and LLC formation pandarouter hermes gateway run --profile pandarouter /root/.hermes/profiles/pandarouter VoIP route management and carrier research Table 2. Telegram Hermes profiles. The actor configured four additional profiles ( dev, check, vuln, deploy ) in a shared Telegram group. While we did not observe any chat artifacts for these profiles, the naming suggests the actor used AI to assist with development, validation, vulnerability testing and deployment automation functions. The Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls. The configuration and the AI-generated scripts on the host shown below in Figure 7 suggest the actor used it for code development. Figure 7. Configuration info on the host. Attribution We assess the actor is a financially motivated, multi-domain criminal operator with no prior reporting. The actor is English-speaking with informal, frequently broken grammar. The alice bot's stored memory describes the actor as a “gamer, OSINT, VoIP entrepreneur” claiming to hold a US LLC and EIN. Figure 8 below shows text from the pandarouter bot's stored memory, which is more candid. Figure 8. Text from the pandarouter bot's stored memory. Table 3 lists further attribution indicators of this actor. Indicator Value Email bugstergap@gmail.com Display name B U G S T E R Cursor IDE user ID 158034011 Telegram user ID 7593151260 Table 3. Attribution indicators. Conclusion This case illustrates how AI lowers the skill barrier for cybercrime. The actor used basic tooling and relied on AI-generated scripts and reconnaissance reports, but still achieved notable impact. They recovered more than 5,200 PII records and mapped multiple organizations' attack surfaces. AI enabled a single actor to operate across diverse attack types (credential theft, VoIP fraud, Wi-Fi cracking, cryptocurrency targeting) that would traditionally require distinct skill sets. The VoIP fraud planning demonstrates a particularly notable use of AI as a domain expert. With DeepSeek V4 as the underlying model, the actor's bot profiles provided detailed, actionable criminal guidance. This guidance included specific fraud-to-clean traffic ratios, carrier audit thresholds to stay below and operational security measures to avoid detection. The model's minimal safety controls allowed it to function as an on-demand criminal advisor, enabling the actor to acquire operational expertise through conversation rather than experience. Combining these findings with our previous reporting on a Chinese-Speaking threat actor leveraging the Hermes + DeepSeek toolchain points to growing uptake of this combination among cybercriminals. Palo Alto Networks customers are better protected from the threats discussed above through the following products: Advanced URL Filtering and Advanced IP Defense identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM are designed to accurately detect the threats described in this article with the Malware Prevention Engine , and behavioral analytics to reveal the root cause to speed up investigations. Cortex Agentic Endpoint Security is designed to help discover every AI artifact and AI agents activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations. Cortex Cloud is designed to protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute and serverless agents , Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to disguise their presence, alter configurations or execute anomalous operations in the environment. Idira Privileged Access Manager (PAM ) is designed to unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets. Idira Identity and Access Manager (IAM) is designed to enable secure, unified access across human, machine, and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login, and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce to meet the security demands of today and tomorrow. Idira Secrets Manager is designed to help secure and automate API keys and webhook tokens just-in-time to eliminate hardcoded credentials and prevent exfiltration. The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service . If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance . Indicators of Compromise 162.243.3[.]92 - actor infrastructure 104.238.38[.]202 - commercial proxy server Additional Resources Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks – Palo Alto Networks Unit 42 Updated 20 October, 2026 at 11:18 AM PDT --> Back to top Tags API Data exfiltration DeepSeek Hermes Agent Payload Telecoms VoIP fraud WordPress Threat Research Center Next: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) Table of Contents Related Articles AI-Powered Espionage Campaign Targets Government Linux Infrastructure Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant Blinder Tunnel Campaign Targets Iraqi Infrastructure Related Malware Resources Threat Research October 15, 2026 AI-Powered Espionage Campaign Targets Government Linux Infrastructure Exfiltration LLM Network security Read now Threat Research October 14, 2026 Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant Apache CL-STA-0954 Logging Read now Threat Research October 6, 2026 Blinder Tunnel Campaign Targets Iraqi Infrastructure Advanced Persistent Threat Agent Serpens AppDomainManager Read now Threat Research September 29, 2026 OperTraitors: How Kubernetes Operators Betray Your Security Posture AI AI agents API Read now Insights September 16, 2026 Atomic macOS (AMOS) Stealer Activity MacOS Threat intelligence Unit 42 Read now Threat Research September 10, 2026 The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE API Cryptographic JSON Read now Threat Research September 9, 2026 Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure ARKTunnel C2 CL-CRI-1171 Read now Threat Research September 3, 2026 Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America Agentic AI ChatGPT CL-CRI-1131 Read now Threat Research August 31, 2026 Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams Cloaked Ursa Entra ID Microsoft Teams Read now