AI Agent Drives Espionage Attack on Thai Ministry of Finance

Threat actors utilized an autonomous AI agent, Hermes, to conduct espionage against Thailand's Ministry of Finance (MOF). The attack, detailed by Hunt.io, was supported by open-source tools such as LinPEAS (Linux Privilege Escalation Awesome Script) and Hades, a custom Windows and Linux implant. The research indicates that the attack was largely driven by Hermes in unrestricted "YOLO" mode, allowing the agent to function without human approval.

Researchers discovered three exposed directories in Hong Kong containing exploit code, Web shells, suo5 HTTP tunnels, and custom scripts. The attacker infrastructure had extensive post-exploitation tooling, including staged privilege-escalation exploit code targeting both Linux and Windows. Specifically, researchers identified a HiveServer2 client using hardcoded credentials and a malicious Hive UDF issuing commands and returning output over WebHDFS, targeting MOF Hadoop infrastructure.

Hades, a custom Windows and Linux implant, was deployed within the MOF environment. It offered interactive remote shell access, persistence tasks, in-memory execution, file transferring, and SOCKS proxying. Hermes was used to support these capabilities, performing system enumeration, privilege escalation, file and service discovery, and network reconnaissance. The research also noted Hermes' use of LinPEAS to further move through the network.

Additional logs indicated the operator instructed the agent to enumerate a content directory containing PDF, DOC, XLS files, and personnel records associated with the Office of Permanent Secretary for Finance. However, no evidence of data exfiltration was found. The infrastructure used by the attackers, including the exposed directories and Hong Kong-based hosting, has previously been associated with Chinese state espionage groups, leading Hunt.io to assess a low-to-medium confidence that the actor behind the activity is Chinese-speaking or intimately familiar with the Chinese language.

Hunt.io recommends that defenders review HiveServer2 authentication mode, as its default accepts any credentials passed over SASL PLAIN without validating them; enforce HiveServer2 UDF blocklists; audit Web roots recursively for PHP files similar to those the attacker used; and patch sudo and polkit to prevent exploits used by the attacker. The incident highlights a pattern of AI-powered attackers exhibiting poor operational security, leaving a substantial trail of evidence due to exposed infrastructure and automated processes.