The original text is in EN, taken from the source site. Source ↗

A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities.

Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200 student and faculty records with personally identifiable information (PII).

The findings show how accessible AI tools can help a relatively inexperienced operator carry out attacks across several criminal areas.

The actor controlled specialized Hermes profiles through Telegram, including “alice,” which advised on VoIP fraud, and “pandarouter,” which researched carriers and call routing.

The operator also tested other AI models and used prompt-level overrides to reduce safety restrictions.

The university attack began with reconnaissance of an online education platform. AI-generated reports mapped 12 subdomains, including a learning-management system, student portal and administration dashboard.

The actor then used WordPress REST API information to identify 13 user accounts, generated a password-guessing tool using 117 usernames and 28 common passwords, and obtained a valid login, according to Unit 42.

In a separate intrusion, the actor used an administrator account with a weak password to access and exfiltrate a MongoDB database containing more than 5,200 records.

Example of a WordPress REST API enumeration report from the activity (Source : Unit42).

Unit 42 Researchers said that, BUGSTER ran the Hermes Agent framework with DeepSeek V4 and used Cursor, an AI coding environment, as an additional tool.

DeepSeek AI Exploited

The operation extended beyond university networks. Unit 42 found credential-scanning tools designed to search websites for exposed secrets, including cloud keys and private keys; scripts for cryptocurrency-holder reconnaissance; and a command-and-control listener supporting reverse-shell connections.

The actor also developed an automated Wi-Fi password-cracking pipeline: a nearby Linux device captured authentication material, which was sent to cloud GPU instances for cracking.

That workflow suggests local physical proximity to the targeted wireless networks, although the report does not identify those locations.

The actor’s AI conversations also explored setting up a fraudulent Voice over Internet Protocol (VoIP) operation.

Actor infrastructure and AI tool relationships (Source : Unit42).

The “alice” profile provided guidance on establishing a business identity, acquiring carrier access, routing calls and evading caller-ID controls.

One AI-generated report included a “NEXT EXPLOIT OPPORTUNITIES” section outlining possible follow-up activity.

However, Unit 42 found no call logs, Session Initiation Protocol (SIP) traces or active call routing.

The evidence therefore indicates planning or early setup not a confirmed VoIP fraud operation or proof that spoofed calls were made.

The distinction matters: the Federal Communications Commission’s STIR/SHAKEN framework authenticates caller-ID information on IP-based phone networks, but the actor’s discussions about bypassing it are evidence of intent and research, not evidence of successful evasion.

Unit 42 says the actor relied on basic tooling and AI-produced scripts and reports, yet still compromised a university and collected thousands of records.

The case illustrates how AI can lower the expertise threshold and let one operator move among credential theft, data theft, wireless attacks, cryptocurrency research and fraud planning.

The finding also connects to a separate Unit 42 investigation published in July 2026, which described another actor using Hermes Agent and DeepSeek for autonomous vulnerability research and attack attempts.

The campaigns are distinct, but both point to growing interest in combining agent frameworks, low-cost models and familiar tools to automate parts of cyber operations.

IOCs

IP AddressTypeDescription
162.243.3[.]92IPv4Threat actor infrastructure
104.238.38[.]202IPv4Commercial proxy server

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.