BUGSTER taxallusidan foydalanuvchi tahdid aktori DeepSeek V4-ni Hindistondagi tashkilotlar, jumladan universitetlarga qaratilgan AI yordamida kiberjinoyatchilik operatsiyasi uchun fikrlash dvigateli sifatida sozladi.
Palo Alto Networks'ning tahdid-razvedka jamoasi Unit 42 ma'lumotlariga ko'ra, aktor AI tomonidan yaratilgan razvedka va skriptlardan foydalanib universitet veb-saytiga qo'pol kuch bilan hujum qildi va 5 200 dan ortiq talaba va o'qituvchilarning shaxsiy identifikatsiya ma'lumotlari (PII) bilan ma'lumotlar bazasini muvaffaqiyatli o'g'irladi.
Topilmalar shuni ko'rsatadiki, foydalanish mumkin bo'lgan AI vositalari nisbatan tajribasiz operatorga bir nechta jinoyat sohalarida hujumlarni amalga oshirishga yordam berishi mumkin.
Aktor Telegram orqali maxsus Hermes profillarini, jumladan VoIP firibgarligi bo'yicha maslahat beruvchi "alice" va tashuvchilar hamda qo'ng'iroqlarni yo'naltirishni tadqiq qiluvchi "pandarouter"ni nazorat qilgan.
Operator boshqa AI modellarini ham sinab ko'rgan va xavfsizlik cheklovlarini kamaytirish uchun so'rov darajasidagi bekor qilishlardan foydalangan.
Universitetga hujum onlayn ta'lim platformasini razvedka qilish bilan boshlangan. AI tomonidan yaratilgan hisobotlar 12 ta subdomenni, jumladan o'quvni boshqarish tizimi, talaba portali va ma'muriyat panelini xaritalagan.
So'ngra aktor WordPress REST API ma'lumotlaridan foydalanib 13 ta foydalanuvchi hisobini aniqlagan, 117 ta foydalanuvchi nomi va 28 ta keng tarqalgan paroldan foydalanib parolni taxmin qilish vositasini yaratgan va Unit 42 ma'lumotlariga ko'ra, haqiqiy kirish ma'lumotlarini qo'lga kiritgan.
Alohida kirishda aktor zaif parolga ega ma'mur hisobidan foydalanib 5 200 dan ortiq yozuvni o'z ichiga olgan MongoDB ma'lumotlar bazasiga kirgan va uni o'g'irlagan.
Faoliyatdan olingan WordPress REST API sanash hisobotining namunasi (Manba: Unit42).
Unit 42 tadqiqotchilari BUGSTER Hermes Agent tizimini DeepSeek V4 bilan ishlatganini va qo'shimcha vosita sifatida AI kodlash muhiti Cursor'dan foydalanganini aytishdi.
DeepSeek AI ekspluatatsiya qilingan
Operatsiya universitet tarmoqlaridan tashqariga ham kengaygan. Unit 42 veb-saytlarni ochiq sirlar, jumladan bulut kalitlari va shaxsiy kalitlar uchun skanerlashga mo'ljallangan ma'lumotlarni o'g'irlash vositalarini; kriptovalyuta egalarini razvedka qilish skriptlarini; va teskari qobiq ulanishlarini qo'llab-quvvatlovchi buyruq va nazorat tinglovchisini topdi.
Aktor shuningdek, avtomatlashtirilgan Wi-Fi parolni buzish quvurini ishlab chiqqan: yaqin atrofdagi Linux qurilmasi autentifikatsiya materialini ushlab olgan, so'ngra u bulut GPU instansiyalariga yuborilgan va u yerda buzilgan.
Bu ish oqimi maqsadli simsiz tarmoqlarga mahalliy jismoniy yaqinlikni ko'rsatadi, garchi hisobot bu joylarni aniqlamagan bo'lsa-da.
Aktorning AI suhbatlari shuningdek, soxta Internet orqali ovoz protokoli (VoIP) operatsiyasini tashkil etishni o'rganib chiqqan.
Aktor infratuzilmasi va AI vositalari munosabatlari (Manba: Unit42).
"alice" profili biznes identifikatorini yaratish, tashuvchi kirish huquqini olish, qo'ng'iroqlarni yo'naltirish va qo'ng'iroq qiluvchi identifikatsiya nazoratini chetlab o'tish bo'yicha yo'riqnoma bergan.
AI tomonidan yaratilgan bitta hisobotda mumkin bo'lgan keyingi faoliyatni bayon qiluvchi "KEYINGI EKSPLOATATSIYA IMKONIYATLARI" bo'limi ham kiritilgan.
Biroq, Unit 42 hech qanday qo'ng'iroq jurnallari, Sessiya boshlash protokoli (SIP) izlari yoki faol qo'ng'iroq yo'naltirishni topmagan.
Shuning uchun dalillar rejalashtirish yoki dastlabki sozlashni ko'rsatadi, tasdiqlangan VoIP firibgarlik operatsiyasi yoki soxta qo'ng'iroqlar amalga oshirilganini isbotlamaydi.
Bu farq muhim: Federal aloqa komissiyasining STIR/SHAKEN tizimi IP asosidagi telefon tarmoqlarida qo'ng'iroq qiluvchi identifikatsiya ma'lumotlarini autentifikatsiya qiladi, lekin aktorning uni chetlab o'tish haqidagi muhokamalari niyat va tadqiqot dalili, muvaffaqiyatli chetlab o'tish dalili emas.
Unit 42 ma'lumotlariga ko'ra, aktor asosiy vositalar va AI tomonidan ishlab chiqarilgan skriptlar hamda hisobotlarga tayangan, shunga qaramay universitetni buzib kirgan va minglab yozuvlarni to'plagan.
Bu holat AI tajriba chegarasini qanday pasaytirishi va bitta operatorga ma'lumotlarni o'g'irlash, simsiz hujumlar, kriptovalyuta tadqiqoti va firibgarlik rejalashtirish o'rtasida harakatlanish imkonini berishini ko'rsatadi.
Bu topilma shuningdek, 2026-yil iyul oyida e'lon qilingan alohida Unit 42 tadqiqotiga bog'lanadi, unda boshqa aktor Hermes Agent va DeepSeek'dan avtonom zaiflik tadqiqoti va hujum urinishlari uchun foydalangani tasvirlangan.
Kampaniyalar alohida, lekin ikkalasi ham agent tizimlari, arzon modellar va tanish vositalarni birlashtirib kiberoperatsiyalarning qismlarini avtomatlashtirishga qiziqish ortib borayotganini ko'rsatadi.
IOC'lar
| IP manzili | Turi | Tavsif |
|---|---|---|
162.243.3[.]92 | IPv4 | Tahdid aktori infratuzilmasi |
104.238.38[.]202 | IPv4 | Tijorat proksi-serveri |
Eslatma: IP manzillari va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fangalang.
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities.
Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200 student and faculty records with personally identifiable information (PII).
The findings show how accessible AI tools can help a relatively inexperienced operator carry out attacks across several criminal areas.
The actor controlled specialized Hermes profiles through Telegram, including “alice,” which advised on VoIP fraud, and “pandarouter,” which researched carriers and call routing.
The operator also tested other AI models and used prompt-level overrides to reduce safety restrictions.
The university attack began with reconnaissance of an online education platform. AI-generated reports mapped 12 subdomains, including a learning-management system, student portal and administration dashboard.
The actor then used WordPress REST API information to identify 13 user accounts, generated a password-guessing tool using 117 usernames and 28 common passwords, and obtained a valid login, according to Unit 42.
In a separate intrusion, the actor used an administrator account with a weak password to access and exfiltrate a MongoDB database containing more than 5,200 records.
Example of a WordPress REST API enumeration report from the activity (Source : Unit42).
Unit 42 Researchers said that, BUGSTER ran the Hermes Agent framework with DeepSeek V4 and used Cursor, an AI coding environment, as an additional tool.
DeepSeek AI Exploited
The operation extended beyond university networks. Unit 42 found credential-scanning tools designed to search websites for exposed secrets, including cloud keys and private keys; scripts for cryptocurrency-holder reconnaissance; and a command-and-control listener supporting reverse-shell connections.
The actor also developed an automated Wi-Fi password-cracking pipeline: a nearby Linux device captured authentication material, which was sent to cloud GPU instances for cracking.
That workflow suggests local physical proximity to the targeted wireless networks, although the report does not identify those locations.
The actor’s AI conversations also explored setting up a fraudulent Voice over Internet Protocol (VoIP) operation.
Actor infrastructure and AI tool relationships (Source : Unit42).
The “alice” profile provided guidance on establishing a business identity, acquiring carrier access, routing calls and evading caller-ID controls.
One AI-generated report included a “NEXT EXPLOIT OPPORTUNITIES” section outlining possible follow-up activity.
However, Unit 42 found no call logs, Session Initiation Protocol (SIP) traces or active call routing.
The evidence therefore indicates planning or early setup not a confirmed VoIP fraud operation or proof that spoofed calls were made.
The distinction matters: the Federal Communications Commission’s STIR/SHAKEN framework authenticates caller-ID information on IP-based phone networks, but the actor’s discussions about bypassing it are evidence of intent and research, not evidence of successful evasion.
Unit 42 says the actor relied on basic tooling and AI-produced scripts and reports, yet still compromised a university and collected thousands of records.
The case illustrates how AI can lower the expertise threshold and let one operator move among credential theft, data theft, wireless attacks, cryptocurrency research and fraud planning.
The finding also connects to a separate Unit 42 investigation published in July 2026, which described another actor using Hermes Agent and DeepSeek for autonomous vulnerability research and attack attempts.
The campaigns are distinct, but both point to growing interest in combining agent frameworks, low-cost models and familiar tools to automate parts of cyber operations.
IOCs
| IP Address | Type | Description |
|---|---|---|
162.243.3[.]92 | IPv4 | Threat actor infrastructure |
104.238.38[.]202 | IPv4 | Commercial proxy server |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.