Unattended AI agent in 'YOLO mode' automated post-exploitation against Thailand's Finance Ministry — a transferable government-network TTP
Hunt.io (with researcher Bob Diachenko) found three simultaneously-exposed open directories — 585 files, ~470 MB of exploit code, webshells, stolen credentials and operator logs — tied to an intrusion against Thailand's Ministry of Finance, published 2026-07-23 (Hunt.io, 2026-07-23). The distinguishing feature is the automation layer: the operator ran Hermes, an open-source autonomous AI agent, and — per Hunt.io — "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." Recovered agent logs show it autonomously enumerating ministry hosts, traversing the filesystem, running a custom LinPEAS privilege-escalation script (probing several 2026 Linux-kernel LPE flaws and older sudo/polkit bugs), enumerating SUID/SGID binaries and running services, and recursively harvesting documents from a target office — each step executed without a human approving it. This is the second AI-agent-driven autonomous-attack disclosure this pipeline has tracked in roughly a week, marking a shift from AI-assisted to AI-unattended post-exploitation where an off-the-shelf agent framework, not bespoke attacker code, is the orchestration layer.
The hands-on tradecraft leaned on default-configuration weaknesses rather than zero-days: a script abusing Apache HiveServer2's default no-validation SASL PLAIN authentication on its service port to register a malicious Java UDF and run shell commands; an Ambari REST-API payload against the Hadoop management layer; and headless-browser automation logging into a GlassFish admin console with default credentials to deploy a JSP webshell via WAR upload (Hunt.io, 2026-07-23). A previously-unreported Go implant, "Hades," provided cross-platform persistence (Registry Run key and scheduled task on Windows, cron on Linux) and beaconed over HTTPS using request paths designed to blend with static JavaScript-asset traffic, with AES-256-GCM-encrypted payloads carried in HTTP bodies and built-in kill-dates and working-hours scheduling to blunt detection. Critically, "the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised" (BleepingComputer, 2026-07-24); ThaiCERT and NCSA were notified 2026-07-15.
the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous.
However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised.
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.