Hermes logs show AI-assisted reconnaissance in alleged Thai finance ministry intrusion

Hunt.io says a separate PHP web shell had been deployed on a ministry web server and that other artifacts indicated access to multiple internal systems. Those are the investigation's most consequential claims, and they remain the researcher's assessment rather than confirmation from the ministry or an incident-response finding.

The AI agent was in the command loop

Hermes can retain information across task sessions and has a YOLO mode that removes prompts for potentially dangerous commands. The recovered configuration and five output logs show that the operator enabled that mode, then tasked the agent with running LinPEAS-based privilege-escalation checks, looking for kernel vulnerabilities and SUID/SGID binaries, enumerating services, inspecting containers and traversing file systems.

One task recursively catalogued PDF, DOC and XLS files in a web directory associated with the Permanent Secretary's office, including personnel and performance-assessment records dating to 2012. Hunt.io found no evidence that those files were exfiltrated. The logs show an agent acting on supplied objectives and tooling; they do not show Hermes choosing the ministry, obtaining access or independently completing the campaign.

That distinction changes what this case demonstrates. Unattended execution can reduce the operator attention needed for repetitive discovery after access is available. It is not evidence, on these facts, that an AI system carried out an end-to-end autonomous intrusion.

Conventional tooling supplies the campaign's leverage

The July 10 directory contained 62 Windows and Linux binaries, including samples of a previously undocumented Go implant that the operator called Hades. Hunt.io analyzed one Windows and one Linux sample and found a shared codebase capable of encrypted command-and-control communications, shell access, file transfer and SOCKS proxying. The Windows version also included persistence, process hollowing and screenshot functions; the Linux version used cron persistence and shellcode execution.

The remaining binaries had similar sizes and build characteristics, but were not individually analyzed. Nor do the staged exploits for PwnKit, the sudo heap overflow and IIS WebDAV establish that any particular vulnerability was used. The available evidence is strongest on an operator preparing several routes, not on which route succeeded.

Hunt.io used shared TLS-certificate characteristics and Hades command-and-control configuration to link the exposed server to two more hosts in Malaysia and Hong Kong. Its assessment that the operator was Chinese-speaking or closely familiar with Chinese is explicitly low to medium confidence, based on language artifacts, use of the FOFA reconnaissance service, hosting and the server's past associations. No threat actor was named; the research also says it cannot confirm whether a VShell server on the infrastructure was used against the ministry.

What would resolve the incident

Hunt.io and Diachenko said they notified Thailand's national CERT and the National Cyber Security Agency on July 15, and that both acknowledged receipt. A ministry confirmation, or an independent incident-response account identifying affected systems and an initial-access path, would settle the central question that the exposed directory cannot: whether the targeting and post-access activity amounted to a verified compromise.

For now, the defensible conclusion is narrower. The infrastructure offers uncommon visibility into a likely operator workflow: conventional malware and target-specific scripts paired with an AI agent executing reconnaissance without per-command approval. It does not establish the scope of access, any data theft, or an autonomous attack on a finance ministry.