IC Technology & Cyber — 2026-07-27

Hackers Deploy Autonomous AI Agent in Espionage Campaign Against Thailand Finance Ministry

BLUFOperational use of an autonomous AI agent against a government target crosses a threshold in offensive cyber capability, though Thai confirmation of the breach remains very unlikely by late August 2026.

Hunt.io and researcher Bob Diachenko found three open directories on a Hong Kong-hosted server active from July 9 to 13, exposing 585 files and about 470 MB of attack code, stolen credentials, and logs from Hermes, an open-source AI agent run in unattended "YOLO mode" against Thailand's Ministry of Finance 1. The logs show the agent independently enumerated ministry hosts, ran a customized LinPEAS privilege-escalation script, and catalogued Office of the Permanent Secretary for Finance files including personnel and performance-evaluation records dating back to 2012, according to Hunt.io and BleepingComputer 12. Researchers also recovered a previously undocumented Go-based implant called Hades, built in 62 Windows and Linux binaries from the same codebase, and said stolen session cookies and web shells indicate access to multiple ministry admin systems, though no recovered artifact shows Hades itself reaching a ministry machine and the ministry has not confirmed a breach 123. Hunt.io found no evidence of data exfiltration, assessed with low-to-medium confidence that the operator is Chinese-speaking based on Hong Kong infrastructure and language indicators, and said Thailand's national CERT and cyber security agency were notified on July 15 and acknowledged receipt the same day 13.

Analysis
Confirmation of a breach from Thailand's Ministry of Finance is very unlikely within 30 days of disclosure, by August 26, 2026. Low confidence reflects the absence of any government statement, denial, or off-record signal beyond routine bureaucratic non-disclosure patterns. Government targets facing unattributed intrusions with no confirmed data loss typically withhold public acknowledgment, and Hunt.io's finding of no exfiltration removes the clearest mechanism that would otherwise force disclosure. The ministry has already declined to comment once, and staged but unactivated Hades command-and-control infrastructure indicates the intrusion was interrupted before the operator confirmed persistent access. The absence of confirmed exfiltration and the ministry's silence fit a reconnaissance operation interrupted before data theft as plausibly as a completed compromise the ministry is suppressing.

4 sources

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged - Hunt.io
Hermes AI agent used to automate attack on Thai Finance Ministry - BleepingComputer
Hackers used autonomous AI agent to spy on Thailand's finance ministry - The Record
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry - The Hacker News