September 14, 2026
- An unattended Hermes agent handled post-exploitation inside Thailand’s Ministry of Finance. From July 9–13, 2026, Hunt.io found three exposed attacker directories containing exploit code, webshells,
suo5tunnels, scripts with hard-coded stolen credentials, and Hermes logs. Those logs showed the agent in approval-disabled “YOLO” mode enumerating ministry hosts, traversing files, and collecting LinPEAS output from an adjacent system. Active session cookies, deployed webshells, and internal-network access indicate compromise of multiple systems, although the initial-access path remains unknown and deployment of two staged WAR files was not confirmed. Recovered Windows and Linux samples belonged to the same custom Go implant, which the operator called Hades, and contained hard-coded C2 addresses. · AI-Enabled Threat Activity