Hermes AI agent used to automate attack on Thai Finance Ministry

A Hunt.io and researcher-led investigation uncovered exposed attacker web directories containing exploit code, web shells, credentials, logs, and Windows/Linux builds of a Go-based implant ('Hades') linked to an operation targeting Thailand's Ministry of Finance; logs show the open-source Hermes AI agent was used in unattended YOLO mode to automate post-exploitation tasks such as privilege escalation, service enumeration, and data cataloging, though the ministry has not confirmed a breach.