AI-Powered Hermes Agent Orchestrates Cyber-Espionage Attack on Thai Ministry of Finance: Technical Analysis and Mitigation Strategies

Executive Summary

A sophisticated cyber-espionage campaign targeting the Thai Ministry of Finance was uncovered in July 2026, involving the use of an autonomous artificial intelligence agent known as Hermes. The attack was discovered by cybersecurity firm Hunt.io and corroborated by multiple independent sources, including The Record and BleepingComputer (Hunt.io, July 23, 2026; The Record, July 27, 2026; BleepingComputer, July 2026). The attackers leveraged Hermes in "YOLO mode," allowing it to autonomously conduct reconnaissance, privilege escalation, and credential theft within the ministry’s network. The operation also involved the deployment of a custom backdoor named Hades, targeting both Windows and Linux systems. While the attackers gained access to multiple internal systems and harvested credentials and session tokens, there is no confirmed evidence of data exfiltration as of the latest reporting. The campaign exploited default credentials and misconfigured authentication on critical infrastructure, including Hadoop clusters and administrative web panels. Attribution remains unconfirmed, but technical indicators suggest a Chinese-speaking operator. ThaiCERT and the National Cyber Security Agency were notified on July 15, 2026, and have since announced plans to strengthen national defenses against AI-powered cyber threats.

Technical Information

The attack on the Thai Ministry of Finance represents a significant escalation in the use of autonomous AI agents for cyber-espionage. The operation was orchestrated primarily through the deployment of the open-source Hermes AI agent, configured in "YOLO mode" to execute commands without human oversight (Hunt.io, July 23, 2026). This allowed the attackers to automate post-compromise activities, including network reconnaissance, privilege escalation, credential harvesting, and lateral movement.

Initial Access

The precise method of initial access remains undetermined. No evidence of phishing, supply chain compromise, or direct exploit chain for initial entry was found in the recovered files (Hunt.io, July 23, 2026; The Record, July 27, 2026). This assessment is based on direct review of attacker infrastructure and logs, and confidence in this finding is high.

Post-Compromise Activity

Once inside the network, the attackers deployed Hermes to autonomously enumerate hosts, traverse files, and capture outputs from privilege escalation tools such as LinPEAS. The agent targeted internal systems, including administrative web panels, Hadoop big-data clusters (notably HiveServer2 and Ambari), document management platforms, and email infrastructure. The operation involved the use of multiple exploits, including:

• CVE-2021-4034 (PwnKit) and CVE-2021-3156 (sudo) for Linux privilege escalation.
• CVE-2017-7269 (IIS WebDAV) for Windows remote code execution.
• Custom scripts exploiting default or misconfigured authentication on HiveServer2 and GlassFish admin consoles.

Webshells disguised as Linux journal cache files were deployed on ministry web servers, supporting command execution, file retrieval, and network connectivity checks. Credential attacks were conducted using scripts with hardcoded and default credentials, targeting both email and Hadoop infrastructure.

Persistence and Command & Control

The attackers deployed a custom backdoor named Hades, written in Go and compiled for both Windows and Linux. Hades provided persistent access, supporting remote command execution and file transfer. The operation utilized multiple command and control (C2) nodes, with infrastructure based in Hong Kong and Malaysia. Webshells and SOCKS5 proxies were also used for internal movement and C2 communications.

MITRE ATT&CK Mapping

The attack chain aligns with several MITRE ATT&CK tactics and techniques, including:

• Execution: Use of command and scripting interpreters, exploitation for client execution.
• Persistence: Deployment of implants and webshells.
• Privilege Escalation: Exploitation of known vulnerabilities and use of valid accounts.
• Defense Evasion: Masquerading and obfuscation of files.
• Credential Access: Credential dumping and brute force attacks.
• Discovery: Network and system information discovery.
• Lateral Movement: Exploitation of remote services and use of valid accounts.
• Collection: Automated collection of data from information repositories.
• Command and Control: Use of application layer protocols and web services.
• Exfiltration: No evidence of data exfiltration was observed.

Attribution

While no direct attribution to a known advanced persistent threat (APT) group has been made, several technical indicators suggest a Chinese-speaking operator. These include the use of Chinese-language passwords, an API key for the Chinese asset search platform FOFA, Hong Kong-based infrastructure, and the server’s history as a controller for malware families previously linked to Chinese APTs (Hunt.io, July 23, 2026). However, there is no conclusive malware overlap or operational fingerprint tying this activity to a specific group, resulting in a low-to-medium confidence assessment.

Data Compromised

The attackers harvested stolen credentials from mail infrastructure, Hadoop clusters, and administrative panels, as well as session tokens for internal systems. Internal system information, including personnel records and office files, was enumerated. All sources agree that, as of publication, there is no evidence of data exfiltration (Hunt.io, July 23, 2026; The Record, July 27, 2026; BleepingComputer, July 2026).

Sectoral Implications

This incident demonstrates the evolving threat landscape for government finance and critical infrastructure sectors. The use of autonomous AI agents for post-compromise operations, exploitation of default credentials, and targeting of big-data clusters and document management platforms highlight persistent weaknesses in authentication and network segmentation. The attack underscores the need for enhanced detection and response capabilities tailored to AI-driven threats.

Affected Versions & Timeline

Malicious activity was traced back to mid-to-late June 2026, with suspicious TLS certificates appearing on attacker infrastructure as early as June 29, 2026 (Hunt.io, July 23, 2026). Between July 9 and July 13, 2026, Hunt.io captured three open directories on 43.246.208[.]207, containing attack code, logs, and evidence of compromise. ThaiCERT and the National Cyber Security Agency were notified and acknowledged the incident on July 15, 2026. Technical analysis was published by Hunt.io on July 23, 2026, and incident summaries appeared in The Record on July 27, 2026.

The affected systems include administrative web panels, Hadoop clusters (including HiveServer2 and Ambari), document management platforms, and email infrastructure within the Thai Ministry of Finance. The operation exploited default credentials and misconfigured authentication, but the specific software versions targeted were not disclosed in the available sources.

Threat Activity

The threat actors leveraged the Hermes AI agent in "YOLO mode" to automate reconnaissance, privilege escalation, credential theft, and lateral movement within the ministry’s network. The operation involved the deployment of the Hades backdoor for persistent access, as well as webshells and custom exploit scripts targeting internal systems. The attackers demonstrated detailed knowledge of the ministry’s internal topology, with custom scripts and hardcoded credentials for specific systems. The campaign focused on mapping the network, harvesting credentials, and cataloguing sensitive files, but no evidence of data exfiltration was found.

Attribution remains unconfirmed, but technical indicators suggest a Chinese-speaking operator, based on infrastructure, language artifacts, and tooling. The operation’s sophistication and focus on government finance systems highlight the increasing use of autonomous AI agents in cyber-espionage campaigns.

Mitigation & Workarounds

Mitigation recommendations are prioritized by severity:

Critical: Immediately audit and rotate all credentials for administrative web panels, Hadoop clusters, and email infrastructure. Disable or restrict default and hardcoded credentials, and enforce strong authentication policies across all critical systems.

High: Patch all systems against known vulnerabilities exploited in this campaign, including CVE-2021-4034 (PwnKit), CVE-2021-3156 (sudo), and CVE-2017-7269 (IIS WebDAV). Review and harden authentication configurations for HiveServer2, GlassFish, and other exposed services to prevent unauthorized access.

High: Conduct a comprehensive review of internal network segmentation and access controls, particularly for big-data clusters, document management platforms, and administrative panels. Implement strict least-privilege access and monitor for anomalous lateral movement.

Medium: Deploy advanced endpoint detection and response (EDR) solutions capable of identifying AI-driven post-compromise activity, including autonomous enumeration, privilege escalation, and credential harvesting.

Medium: Monitor for the presence of known indicators of compromise (see below), including suspicious network connections, file hashes, and webshell activity. Validate all indicators before enforcement.

Low: Provide targeted security awareness training for IT and administrative staff, emphasizing the risks of default credentials and the importance of timely patching.

Indicators of Compromise

The following indicators are point-in-time and should be validated in your environment before enforcement. They are based on direct extraction from primary sources (Hunt.io, July 23, 2026).

References

The Record, July 27, 2026: https://therecord.media/thailand-hackers-ai-finance-ministry Hunt.io, July 23, 2026: https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent BleepingComputer, July 2026: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/amp/

About Rescana

Rescana provides a third-party risk management (TPRM) platform designed to help organizations identify, assess, and monitor cyber risks in their supply chain and vendor ecosystem. Our platform enables continuous monitoring for emerging threats, including AI-driven attacks, and supports rapid identification of exposed credentials, vulnerable infrastructure, and anomalous activity relevant to incidents such as the one described in this report.

We are happy to answer questions at info@rescana.com.