--- schema: 1 kind: incident title: "Unattended AI agent in 'YOLO mode' automated post-exploitation against Thailand's Finance Ministry — a transferable government-network TTP" headline: "Exposed operator infrastructure shows an open-source AI agent running privilege-escalation triage with no human in the loop" summary: > Hunt.io recovered 585 files of operator tooling and logs from exposed directories tied to an intrusion targeting Thailand's Ministry of Finance, showing the open-source Hermes AI agent run in "YOLO mode" — human approval prompts stripped — to autonomously enumerate hosts, run LinPEAS privilege-escalation triage and harvest documents, alongside a previously-unreported Go implant ("Hades"). The Ministry has not confirmed compromise; the value is the tradecraft — unattended AI-agent post-exploitation transferable to any government or finance-sector network. discovered_at: "2026-07-25T04:38:26Z" event_date: "2026-07-23" run_id: 2026-07-25T0409Z-intel priority: notable immediate_action: null tags: [ai-abuse, espionage] regions: [apac, global] sectors: [public-sector, finance] entities: [incident:thailand-finance-ministry-hermes-ai-agent-2026, tool:hermes-ai-agent, tool:hades-implant] techniques: [T1190, T1068, T1505.003, T1071.001, T1547.001, T1053.005] affected_products: ["Apache Hive", "Apache Ambari", "Eclipse GlassFish"] cves: [] sources: - url: "https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent" publisher: "Hunt.io / Bob Diachenko" date: "2026-07-23" role: primary - url: "https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/" publisher: "BleepingComputer" date: "2026-07-24" role: corroborating closed_sources: [] evidence: - quote: "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." publisher: "Hunt.io" - quote: "However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised." publisher: "BleepingComputer, citing Hunt.io" verification: single-source sourcing_note: "Hunt.io is the sole primary investigation (based on exposed operator infrastructure it directly observed); BleepingComputer re-reports it rather than independently corroborating. The Ministry of Finance has not confirmed compromise, and successful webshell deployment could not be confirmed at publication — framed as a targeting/tradecraft disclosure, not a confirmed breach. Attribution is Hunt.io's own low-to-medium-confidence Chinese-speaking-operator assessment; not adopted here as a firm nexus." confidence: medium update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: [] migrated_from: null --- Hunt.io (with researcher Bob Diachenko) found three simultaneously-exposed open directories — 585 files, ~470 MB of exploit code, webshells, stolen credentials and operator logs — tied to an intrusion against Thailand's Ministry of Finance, published 2026-07-23 ([Hunt.io, 2026-07-23](https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent)). The distinguishing feature is the automation layer: the operator ran Hermes, an open-source autonomous AI agent, and — per Hunt.io — "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." Recovered agent logs show it autonomously enumerating ministry hosts, traversing the filesystem, running a custom LinPEAS privilege-escalation script (probing several 2026 Linux-kernel LPE flaws and older sudo/polkit bugs), enumerating SUID/SGID binaries and running services, and recursively harvesting documents from a target office — each step executed without a human approving it. This is the second AI-agent-driven autonomous-attack disclosure this pipeline has tracked in roughly a week, marking a shift from AI-*assisted* to AI-*unattended* post-exploitation where an off-the-shelf agent framework, not bespoke attacker code, is the orchestration layer. The hands-on tradecraft leaned on default-configuration weaknesses rather than zero-days: a script abusing Apache HiveServer2's default no-validation SASL PLAIN authentication on its service port to register a malicious Java UDF and run shell commands; an Ambari REST-API payload against the Hadoop management layer; and headless-browser automation logging into a GlassFish admin console with default credentials to deploy a JSP webshell via WAR upload ([Hunt.io, 2026-07-23](https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent)). A previously-unreported Go implant, "Hades," provided cross-platform persistence (Registry Run key and scheduled task on Windows, cron on Linux) and beaconed over HTTPS using request paths designed to blend with static JavaScript-asset traffic, with AES-256-GCM-encrypted payloads carried in HTTP bodies and built-in kill-dates and working-hours scheduling to blunt detection. Critically, "the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised" ([BleepingComputer, 2026-07-24](https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/)); ThaiCERT and NCSA were notified 2026-07-15. **Defender takeaway:** the transferable signal for a government or finance-sector defender is behavioral and tool-agnostic. Unattended agent-driven reconnaissance produces an unusually broad, sequential burst from a single host — kernel-version checks, SUID/SGID sweeps, service enumeration and recursive document harvesting compressed into a short window — that looks like a scanner but is scoped to sensitive internal subnets and carries no change-management ticket. **Triage:** a legitimate vulnerability-scan or patch-compliance sweep is enterprise-wide and change-ticketed; the discriminator here is scope (targeted ministry subnets), sequence (enumeration flowing directly into privilege-escalation attempts and document collection), and the absence of an authorised scan window. The Apache Hadoop stack, Ambari and GlassFish admin surfaces were reachable and default-configured — organisations running those services should treat management-plane exposure and default authentication on them as the concrete hardening lever this incident illustrates.