Thailand's Ministry of Finance: Autonomous AI Agent Ran Post-Exploitation Unattended

An espionage operation against Thailand's Ministry of Finance (MOF) was orchestrated in large part by Hermes, an open-source autonomous AI agent, running in unattended "YOLO mode" with command-approval prompts disabled. The activity was uncovered by threat intelligence firm Hunt.io working with independent researcher Bob Diachenko, who found three simultaneously exposed open directories on a Hong Kong-hosted server between July 9 and July 13, 2026. Hunt.io published its findings on July 23 (Dark Reading, ctipilot, Security Affairs; ESSGroup dates the report to July 28). The directories held 585 files totalling roughly 470 MB per Hunt.io's count as relayed by Geek Feed and ctipilot, described by Security Affairs as "nearly 600 files." Critically, the Ministry of Finance has not confirmed a breach and the Thai government has not publicly commented, so this brief treats compromise as reported-by-researchers rather than victim-confirmed.

What Happened

Hunt.io's Attack Capture platform flagged three open directories exposed simultaneously on attacker staging infrastructure during a four-day window in July. ESSGroup, an OTHER-tier source, identifies the staging server as 43.246.208.207; that IP is not corroborated by the outlet reporting and should be treated as unconfirmed. The contents amounted to a live look inside an operation still in progress: exploit code for multiple CVEs, PHP and JSP web shells, suo5 HTTP tunnelling tools, custom scripts, stolen credentials, active authentication cookies, compiled implants, and, most consequentially, logs generated by the Hermes agent itself.

Hermes is an open-source AI agent released earlier in 2026 by AI research company Nous Research, according to The Record and Blade Intel. Its "YOLO mode" lets the agent execute commands without pausing for human approval. Hunt.io's assessment, quoted by ctipilot, is that "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous."

The recovered agent logs show the tool working through post-exploitation on its own: enumerating ministry hosts, traversing filesystems, running a customised LinPEAS privilege-escalation script, cataloguing SUID/SGID binaries and running services, and recursively harvesting documents from a targeted office. Scripts in the dump referenced MOF systems by name, hostname, and internal IP address.

Accounts diverge on how far the intrusion actually got. The Record, Blade Intel, and Security Affairs report that the exposed files contained evidence attackers had already gained access to multiple systems inside the ministry, including a PHP web shell Hunt.io says was deployed on an MOF web server. Geek Feed notes the counterweight: some recovered artifacts demonstrate only that particular systems were targeted, not that they were successfully compromised. Both readings come from the same underlying research, so the honest position is that access to some ministry systems is well-evidenced while the full blast radius is not established.

What Was Taken

No source reports a confirmed exfiltration volume, record count, or dataset inventory. There is no breach notification, no regulator filing, and no ministry statement to anchor a number to, and any figure circulating for this incident should be treated as unsupported.

What the research does establish is collection intent and capability. Hermes logs captured recursive directory scans of a government web root that ESSGroup reports contained personnel records, and ctipilot describes the agent recursively harvesting documents from a target office. Stolen credentials and active authentication session cookies were sitting in the exposed directories, as were scripts testing authentication against ministry mail servers using hardcoded email addresses and passwords. Hunt.io's file inventory points at administrative web portals, email systems, and document infrastructure as the collection targets.

The practical read: credentials, session material, and internal documents were within reach and at least partially staged on attacker infrastructure. Whether they left the network in bulk is unknown from public reporting.

Why It Matters

This is a category shift, not just another espionage case. Previous AI-in-intrusion reporting has largely described AI-assisted work, where a human operator uses a model as a force multiplier. Here the orchestration layer was an off-the-shelf open-source agent framework executing post-exploitation steps without a human in the approval loop. ctipilot flags it as the second autonomous-agent attack disclosure in roughly a week; Dark Reading connects it to a case detailed earlier in July by incident response firm Sygnia, in which a lone attacker used AI to orchestrate a complex campaign against a large AWS customer environment that ended in successful extortion.

Two consequences follow for defenders. First, the barrier to running a competent post-exploitation campaign against a government network has dropped to the cost of a commodity agent and a foothold. Second, the tempo changes: an unattended agent enumerates, escalates, and collects at machine speed and does not sleep between shifts, compressing the detection window that most SOC staffing models assume.

The tradecraft itself is also a warning about where the real exposure sits. As ctipilot notes, the hands-on activity leaned on default-configuration weaknesses rather than zero-days. The AI did not need to be clever; it needed a network where big-data management planes were reachable and shipped with defaults intact.

The Attack Technique

Initial access remains unknown. The Record, Blade Intel, and ESSGroup all state that researchers could not determine how the attackers first breached the ministry's network, and no clear foothold was identified in the recovered artifacts.

Post-exploitation, as reconstructed from the exposed tooling and agent logs, targeted the ministry's Hadoop estate and Java application infrastructure:

• Apache HiveServer2 abuse. A script exploited HiveServer2's default no-validation SASL PLAIN authentication on its service port to register a malicious Java UDF and execute shell commands (Hunt.io via ctipilot).
• Apache Ambari. A REST-API payload aimed at the Hadoop management layer.
• GlassFish administrative console. Headless-browser automation logged into the console using default credentials and deployed a JSP web shell via WAR upload.
• Mail servers and an administrative web panel. Scripts tested authentication with hardcoded credentials.
• Privilege escalation. ctipilot reports the custom LinPEAS variant probed several 2026 Linux kernel LPE flaws alongside older sudo and polkit bugs. ESSGroup, an OTHER-tier source, specifically names staged exploits for CVE-2021-3156 (Baron Samedit sudo heap overflow) and CVE-2021-4034 (PwnKit), plus a Metasploit module for CVE-2017-7269 (IIS WebDAV); these specific CVE attributions are single-source and uncorroborated by the outlet reporting.
• Tunnelling and shells. suo5 HTTP tunnels and both PHP and JSP web shells provided access paths.

Persistence was handled by Hades, a previously undocumented implant. The Record and Blade Intel describe it as a custom backdoor with Windows and Linux builds capable of remote command execution and file transfer. ESSGroup adds detail not corroborated elsewhere: a Go-built dual-stage design beaconing over HTTPS with URIs mimicking static web assets, persisting via registry run keys and scheduled tasks on Windows and cron jobs on Linux, with Go binaries named after legitimate system processes such as ctfmon and kworker.

On disclosure: Hunt.io and Diachenko reported the activity to Thailand's national CERT and its National Cyber Security Agency (NCSA) on July 15, and the government acknowledged receipt the same day, per Dark Reading. Geek Feed says it contacted both the Ministry of Finance and ThaiCERT and had not received a response at publication.

What Organizations Should Do

1. Audit Hadoop-ecosystem defaults now. HiveServer2 with SASL PLAIN and no validation, Ambari REST endpoints, and Hive UDF registration are the exact path used here. Enforce Kerberos or equivalent strong authentication on Hive and Ambari, restrict UDF creation, and confirm these service ports are not reachable from general-purpose network segments.
2. Hunt for default credentials on Java application consoles. GlassFish, Tomcat, JBoss, and WebLogic admin panels with factory logins remain a reliable route to code execution via WAR or JSP deployment. Disable console exposure entirely where remote administration is not required, and alert on WAR/JSP upload events.
3. Build detections for agentic tempo, not just agentic tooling. Look for high-volume, rapid-fire, low-variance command sequences from a single session: mass SUID/SGID enumeration, back-to-back privilege-escalation script runs, recursive filesystem walks against document repositories. Unattended agents produce distinctly non-human pacing and ordering.
4. Treat session cookies as credentials. Active authentication cookies were among the recovered loot. Shorten session lifetimes on administrative portals and webmail, bind sessions to device or network attributes, and invalidate all sessions on any suspicion of host compromise.
5. Patch the boring privilege-escalation classics. Sudo and polkit flaws from 2021 were still worth staging against this environment. Confirm CVE-2021-3156 and CVE-2021-4034 are remediated fleet-wide, and prioritise current-year Linux kernel LPE patches on internet-adjacent hosts.
6. Assume file staging happens before exfiltration. Monitor for recursive archive creation and unusual outbound HTTPS to endpoints requesting static-asset-shaped URIs. Egress filtering and TLS inspection on server segments materially raise the cost of the Hades beaconing pattern.
7. Check your own exposure the way researchers found theirs. This entire operation was exposed because the attackers left directories open. Scan your perimeter and any cloud-hosted staging assets for unauthenticated directory listings.

Sources: Hermes AI agent used to automate attack on Thai Finance Ministry -... | Hackers used autonomous AI agent to spy on Thailand's finance minis... | AI Agent Drives Espionage Attack on Thai Ministry of Finance | Unattended AI agent in 'YOLO mode' automated post-exploitation agai... | Thailand’s Ministry of Finance Targeted With Hermes AI Agent Runnin... | Autonomous AI Agent Espionage Campaign Targeting Thai Government Fi... | Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Tha... | Hackers used autonomous AI agent to spy on Thailand’s finance minis...