AI-Driven Cyberattack Targets Thailand's Ministry of Finance

A cyberattack utilizing the Hermes AI agent targeted Thailand's Ministry of Finance between July 9 and July 13, 2026. Researchers from Hunt.io discovered exposed directories containing 585 files, including exploit code and stolen credentials. The Hermes agent operated in unattended 'YOLO' mode, allowing it to autonomously navigate and compromise multiple internal systems. The attack exploited vulnerabilities in the ministry's Hadoop infrastructure and involved a previously undocumented Go implant named 'Hades'. Although the Ministry of Finance has not confirmed a breach, evidence suggests that sensitive personnel data may have been accessed. The incident underscores the risks associated with AI tools in cyberattacks, particularly when safety features are disabled. Thailand's national CERT was notified on July 15, 2026, but no public statement has been made as of July 24, 2026.

Key Points: • The Hermes AI agent was used in unattended mode to automate the attack on the Ministry of Finance. • Over 585 files, including exploit code and stolen credentials, were discovered on exposed directories. • The attack exploited vulnerabilities in the ministry's Hadoop infrastructure and involved a new Go implant named 'Hades'.