UNIT 42 describes a financially motivated threat actor, operating under the handle BUGSTER, who leveraged AI-assisted tools to plan and execute a range of cybercrime activities. Using the Hermes Agent framework with DeepSeek V4 as the reasoning engine, the actor configured multiple Telegram-based profiles and a Cursor IDE environment to generate, test and deploy AI-generated scripts and reconnaissance reports.
The operation spanned several domains, including credential theft and data exfiltration, VoIP telecommunications fraud, Wi‑Fi password cracking, cryptocurrency reconnaissance, and C2 payloads. The actor’s setup included bypassing safety controls, with system prompts designed to override model safety and enable agentic functionality, and evidence that they experimented with several models (GLM 5.2, Claude Opus 4.8, GPT-5.5, and others) before settling on DeepSeek V4 for active operations.
The technical findings detail concrete impact, including a WordPress brute-force campaign against an Indian university’s online education platform, enumeration of 12 subdomains and 13 active user IDs, and a brute-force tool that yielded a valid credential. In a second Indian university, the actor exfiltrated a MongoDB database containing thousands of records with PII, and the group conducted e‑commerce and aircraft-style reconnaissance on another Indian site.
VoIP fraud planning was explicit, with guidance on forming a legitimate front, carrier access, traffic mixing to evade audits, STIR/SHAKEN bypass and monetisation strategies. Additional activity included a C2 listening port, Wi‑Fi password cracking with local proximity requirements, a credential-scanning toolkit, and cryptocurrency whale reconnaissance. Indicators of compromise include actor infrastructure at 162.243.3.[...]92 and a commercial proxy at 104.238.38.[...]202. The report emphasises the ease of AI-enabled cybercrime and highlights protective measures across Palo Alto Networks products.