Threat Pulse 62High
Unit 42: low-skill actor used a Telegram-driven AI agent to steal 5,200+ university records
Severity 5Status unknownconfirmedEducationAI and software supply chainAI-related

Palo Alto Networks Unit 42 traced an actor called BUGSTER who ran the Hermes Agent framework on DeepSeek V4 through Telegram bots, with safety controls disabled, to plan credential theft, VoIP fraud, Wi-Fi cracking and crypto reconnaissance. The actor exfiltrated a MongoDB database with more than 5,200 student and faculty records from an Indian public university through an admin account with a weak password. Unit 42 says the actor lacked the skills these activities normally require.

AI angle: Hermes Agent on DeepSeek V4 with safety controls disabled, driven over Telegram

· 15 days ago · 5,200+ records at one university, multiple Indian targets · Unit 42 report
SourcesUnit 42 reportBleepingComputer
Why this score

Thousands of records, AI-assisted low-skill actor, weak-password entry

Back to the board

Updated Nov 5, 01:46 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.