The Attacker Got an Agent and a Targeting Model in the Same Week
- Patrick Duggan
- 16 minutes ago
- 5 min read
Two stories landed 24 hours apart this week and almost nobody put them next to each other.
On July 23, researchers documented Dolphin X, a Windows infostealer sold on a crime forum for 69.95 euros a month, whose headline feature is an "AI Profiler" that scores infected machines and hands the operator a daily ranked list of which victims are worth robbing first.
On July 24, Hunt.io and Bob Diachenko published evidence that someone pointed the open-source Hermes AI agent at Thailand's Ministry of Finance, put it in unattended YOLO mode, and let it do the post-exploitation work by itself.
One of those automates the hands. The other automates the judgment. That is the whole attack lifecycle, and it got cheaper in the same week.
What Hermes actually did
Between July 9 and July 13, three open directories sat exposed on a staging server in Hong Kong. Hundreds of files. The operator had left the agent's own output on disk, in a folder called hermes-results, one text file per agent call.
That is the part that matters. We are not inferring agentic behavior from telemetry. We are reading the agent's transcript.
The logs show a human supplying objectives and tooling, then YOLO mode letting the agent run routine post-exploitation without asking permission each time. It checked hosts for privilege-escalation paths. It walked file systems. It crawled a directory of ministry staff personnel records going back to 2012.
The staged toolkit was not exotic. Exploit code for CVE-2017-7269 in IIS WebDAV, CVE-2021-3156 in sudo, CVE-2021-4034 PwnKit, plus four newer Linux privilege-escalation bugs including CVE-2026-43503 and CVE-2026-31431. Webshells. suo5 HTTP tunnels. Custom scripts with hardcoded stolen credentials aimed at mail infrastructure and Apache Hadoop.
And an unreported Go implant the operator calls Hades, in Linux and Windows builds, beaconing to 43.246.208.207 on 443 and 202.181.27.115 on 12443, disguising its check-in, tasking, and upload channels as requests for app.min.js, vendor.js, and main.js. Persistence via a Run key and a scheduled task on Windows, a cron job on Linux.
The Ministry of Finance has not confirmed a breach. Some artifacts prove targeting, not compromise. Thailand's CERT and NCSA were notified July 15. Hold that distinction — it is the honest read and it does not weaken the story.
Why the agent is the story, not the implant
Strip the AI out and this is a competent, unremarkable intrusion. The exploits are old. The implant is decent but not novel. A capable operator does all of this by hand.
The difference is what it costs to do it at scale.
The expensive part of post-exploitation has never been the exploit. It is the hours of a skilled human sitting in a foreign network deciding what to look at next — which host, which share, which directory of personnel files going back fourteen years is worth pulling. That is judgment work, it does not parallelize, and it is why intrusion crews have always been capacity-limited.
YOLO mode is an attempt to make that part free.
We have been tracking this from the other side for months. GuardFall found shell injection in ten of eleven AI coding agents. We wrote up the week of sandbox escapes. We mapped the agent as a new pivot point in the attack chain. Every one of those was about the agent as a victim — the thing an attacker breaks into or tricks.
Hermes is the same technology as the operator. Same autonomy, same tool access, same willingness to keep going without a human in the loop. We spent a year asking whether AI agents can be trusted with your shell. Somebody answered by giving one to an intruder.
And Dolphin X answers the other half
Automating execution creates a problem: volume. If you can compromise a thousand machines cheaply, you now have a thousand machines and no idea which three matter.
Dolphin X sells the answer. It targets more than 300 applications. A single stolen archive can carry credentials from nine browsers, over 100 crypto wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools — browser passwords, SSH keys, cloud tokens, .env files. Then the profiler scores each victim on application usage, browsing activity, and installed software, and mails the operator a ranked daily summary.
Seventy euros a month for triage-as-a-service.
Our honest position
We had none of it. Not one of the four Hunt.io network indicators — 43.246.208.207, 202.181.27.115, 103.97.0.57, 118.107.222.232 — was in our corpus when we checked. Not the domain redhatupdating432.dnsrd.com. Not the Hades hashes.
We were not early on this. We are ingesting it now and it will be in the feed with attribution, which means anyone pulling our blocklist gets it whether or not they can afford Hunt.io. That is the job we can actually do here: not claim the discovery, carry it to the people who would otherwise never see it.
Credit for the find belongs to Hunt.io and Bob Diachenko, and for Dolphin X to the Varonis researchers who pulled it apart.
What to do about it
Do not model the AI as a better exploit. It is not. Your patch cadence for CVE-2021-4034 and CVE-2021-3156 does exactly as much good against Hermes as it did last year. The old bugs are still the door.
Do model it as more attacker-hours. The crews that could only run three intrusions at a time can now run more. Your assumption that a nation-state-adjacent operator would not bother with your mid-size org was always an economics argument, and the economics just moved.
Hunt the transcript, not just the binary. An unattended agent is chatty. It enumerates broadly, touches directories a human with a specific objective would skip, and generates a distinctive burst of shallow reconnaissance. That noise is a detection opportunity you did not have against a patient human.
Watch for the beacon shape. Hades hides in plain sight as static asset requests. Any implant asking your server for app.min.js on a schedule, from a host that has no business rendering a webpage, is worth a look.
We are 95 percent confident that agent-assisted intrusion becomes normal rather than notable within a year. The remaining five percent is the possibility that YOLO mode turns out to be loud enough, and dumb enough, that defenders end up preferring it to a careful human. We would take that trade.
Indicators from this campaign are being ingested into the DugganUSA feed with attribution to the original researchers. The blocklist is free at analytics.dugganusa.com.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.