{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/bugster/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["BUGSTER"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eUnit 42 investigated a threat actor identified as BUGSTER who weaponized AI assistants - specifically the Hermes Agent framework integrated with DeepSeek V4 - to coordinate multiple types of cybercrime. The actor operated with safety controls disabled in their AI tools.\u003c/p\u003e\n\u003cp\u003eObserved activities include:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Theft and Data Exfiltration\u003c/strong\u003e: The actor utilized AI-generated reconnaissance to enumerate WordPress subdomains and REST APIs, leading to brute-force attacks and the successful exfiltration of a MongoDB database containing over 5,200 student and faculty records.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVoIP Fraud Planning\u003c/strong\u003e: The actor utilized AI bot profiles to acquire actionable knowledge on forming US-based LLCs, carrier access, and techniques for bypassing caller identity verification.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eWi-Fi Password Cracking\u003c/strong\u003e: The actor maintained automated pipelines to capture WPA authentication material from nearby access points for remote cracking.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCryptocurrency Reconnaissance\u003c/strong\u003e: The actor scraped data on cryptocurrency holders for potential future targeting.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe investigation confirmed the actor's ability to execute these activities across diverse domains by leveraging AI as an expert advisor and task-automation tool.\u003c/p\u003e\n","date_modified":"2026-10-21T16:05:57Z","date_published":"2026-10-21T16:05:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ai-assisted-cybercrime/","summary":"A threat actor using the handle BUGSTER utilized the Hermes Agent framework and DeepSeek V4 to facilitate credential theft, database exfiltration, VoIP fraud planning, and Wi-Fi password cracking.","title":"BUGSTER Threat Actor: AI-Assisted Cybercrime","url":"https://feed.craftedsignal.io/briefs/2026-10-ai-assisted-cybercrime/"}],"language":"en","title":"CraftedSignal Threat Feed - BUGSTER","version":"https://jsonfeed.org/version/1.1"}