RESEARCHERS at Hunt.io discovered a cyber-espionage attack on Thailand’s Ministry of Finance involving an autonomous AI agent called Hermes and a custom malware known as Hades. The operation, which was still active at the time of discovery, involved staging servers that contained tools, stolen credentials, and logs. Hermes functioned as an automated assistant performing tasks such as privilege escalation and reconnaissance without human intervention.
The implant Hades was designed for cross-platform operations, complete with functionalities for command-and-control communications and evading detection. The investigation also revealed specific targeting of internal systems such as Apache Hadoop and compromised credential management. While the initial access method remains unknown, indicators suggest a Chinese-speaking threat actor due to language artifacts and infrastructure connections.