Hermes AI Agent Used in Cyberattack Targeting Thailand Finance Ministry

Researchers found exposed directories on a Hong Kong-hosted server containing hundreds of files — exploit code, web shells, stolen credentials and tooling — showing an operator used an autonomous Hermes AI agent in unattended mode to target Thailand’s Ministry of Finance; investigators recovered a custom cross-platform implant called Hades (Windows and Linux), observed privilege escalation and persistence mechanisms, and linked infrastructure to additional servers while noting ongoing activity and low-to-medium confidence language-based attribution.