[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNGHzczWt6NJyPLh1hpxnXGAbez2mKnmkoBxJ0tDvV80":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"83756d2b-e434-4c01-ad87-c3a891a5b774","Hermes AI agent used to automate attack on Thai Finance Ministry","hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry-d3aafa","A threat actor used the open-source Hermes AI agent in unattended \"YOLO\" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [...]","An alleged breach of Thailand's Ministry of Finance involved the use of the open-source Hermes AI agent to automate post-exploitation activities. Threat intelligence researchers discovered exposed directories containing attack artifacts, including web shells, exploit code, and logs indicating the AI agent operated in an unattended 'YOLO' mode, executing commands without human approval. While the ministry has not confirmed a breach, evidence suggests targeting of internal systems, including Hadoop, Apache Ambari, and mail servers.","Hermes AI agent used to automate attacks on Thailand's Ministry of Finance.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F05\u002F12\u002Fevil-hacker-ai.jpg","2026-07-24T19:09:09+00:00","2026-07-24T20:00:24.5197+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Hermes","product",{"name":21,"type":19},"Hades",{"name":23,"type":24},"AI","technology",{"name":26,"type":19},"YOLO mode",{"name":28,"type":19},"LinPEAS",{"name":30,"type":31},"Hunt.io","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"ip","118.107.222.232","Attacker-controlled infrastructure in Malaysia",{"type":57,"value":61,"context":62},"202.181.27.115","Attacker-controlled infrastructure in Hong Kong",[30,18,21],{"controls":65,"vendors":148},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[71,78,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":73,"url":76,"description":77},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":44,"name":124,"problem":125,"products":126},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":144,"product_name":145,"url":146,"description":147},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"ai-automated-post-exploitation-highlights-unpatched-infrastructure-risks","AI-Automated Post-Exploitation Highlights Unpatched Infrastructure Risks","Threat actors leveraged the open-source Hermes AI agent to autonomously execute post-exploitation commands against Thailand's Ministry of Finance, targeting unpatched or misconfigured services including Hadoop, Apache Ambari, and mail servers. The 'YOLO' mode operation — where the AI executed commands without human approval — represents a dangerous escalation in attack automation, reducing the time defenders have to detect and respond. Critically, attack artifacts such as web shells, exploit code, and logs were left in exposed directories, indicating both poor configuration hygiene and inadequate monitoring of internet-facing systems. This incident underscores that AI-assisted attacks can dramatically compress the exploitation lifecycle, making proactive vulnerability management and real-time monitoring non-negotiable for critical government infrastructure.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 CM-6 (Configuration Settings)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST CSF DE.CM-1 (Network Monitoring)","MITRE ATT&CK T1505.003 (Web Shell)","MITRE ATT&CK T1059 (Command and Scripting Interpreter)","ISO\u002FIEC 27001 Annex A 12.6 (Technical Vulnerability Management)",{}]