Hermes AI Agent in YOLO Mode Automates Attack on Thai Ministry of Finance

Introduction

Between July 9 and 13, 2026, an unidentified threat actor exploited the open-source AI agent Hermes to automate post-exploitation phases against the Thai Ministry of Finance. The operation was discovered through three exposed directories on a server based in Hong Kong, containing 585 files totaling approximately 470 MB: exploits, web shells, tunneling tools, custom scripts, stolen credentials, and logs generated by Hermes itself. The agent was operating in "YOLO" mode (automatic execution without human confirmation), dramatically reducing the need for manual interaction and accelerating malicious activities. Although no data exfiltration was detected, the extent of access and the nature of the compromised information render the incident of high/critical severity.

Technical Analysis

Researchers at Hunt.io, led by Bob Diachenko, identified on a server with IP 202.181.27.115 (Hong Kong) a publicly accessible web directory containing the entire offensive arsenal. Among the tools found are:

• Hades, a custom Go-based implant compatible with Windows and Linux.
• A PHP web shell deployed on a Ministry web server.
• A modified version of the LinPEAS enumeration script.
• HTTP tunneling tools for persistence and bypassing network restrictions.

Hermes, in YOLO mode, automatically performed system enumeration, kernel vulnerability scanning, searching for SUID/SGID binaries, inspecting Docker containers, and filesystem navigation. Logs show that the agent catalogued PDF, DOC, and XLS files (personnel assessments and records dating back to 2012) in the web directory of the Office of the Permanent Secretary.

The files contain references to internal Ministry systems (hostnames, private IPs) and indicate as targets services like Apache Ambari, GlassFish, Hadoop, a web admin panel, and mail servers. The malicious infrastructure also includes IP 118.107.222.232 (Malaysia); both servers shared TLS certificates with the same JA4X fingerprint, allowing correlation of activities. The initial access vector remains unknown, and the Ministry has not yet officially confirmed the breach.

Impact

The compromise granted unauthorized access to multiple internal systems, with potential exposure of credentials and confidential documents (personnel records, performance evaluations). Even in the absence of confirmed exfiltration, the breadth of access and the presence of implants like Hades represent a concrete risk of delayed data theft, lateral movement, or future attacks (e.g., ransomware). The incident also entails significant reputational damage for the Ministry and possible diplomatic and economic repercussions for Thailand.

Mitigation

To contain and prevent similar attacks, the following measures are recommended:

• Reduce the attack surface: Disable public exposure of administrative panels (Ambari, GlassFish), enforce strong authentication, and segment the network.
• Implement indicators of compromise (IoCs): Block malicious IPs (118.107.222.232, 202.181.27.115), monitor JA4X TLS certificate fingerprints, and hashes of the Hades implant.
• Behavioral detection: Configure rules to identify typical AI automation sequences (e.g., execution of LinPEAS, Hermes command patterns in YOLO mode) and the use of web shells.
• Principle of least privilege: Restrict the rights of service accounts and users to contain post-exploitation impact.
• Patch management: Promptly update exposed services (Hadoop, GlassFish, Apache Ambari) and monitor logs for known exploit attempts.
• TLS infrastructure review: Revoke or renew suspicious certificates and verify server configuration.
• Collaboration and notification: Share IoCs with national CERTs and internal security teams.

FAQ

1. What does "YOLO mode" mean for an AI agent and why is it dangerous?
YOLO mode (You Only Live Once) in Hermes automatically executes commands and operations without waiting for human confirmation. In an attack, this automates phases such as enumeration, data collection, and lateral movement, making the operation faster and harder to detect manually.

2. What are the risks even without immediate exfiltration?
The attacker may have already gained persistent access and catalogued sensitive documents, preparing for future theft, espionage operations, or sabotage (e.g., ransomware). Additionally, stolen credentials can fuel further attacks.

3. How can defenses detect an AI-automated attack?
It is necessary to implement behavioral detection for anomalous command sequences (e.g., mass execution of scripts like LinPEAS, SUID searches), monitor traffic to known IoCs (IPs, JA4X TLS fingerprints), and use internal honeypots to intercept suspicious activity.