BUGSTER Threat Actor: AI-Assisted Cybercrime

Unit 42 investigated a threat actor identified as BUGSTER who weaponized AI assistants - specifically the Hermes Agent framework integrated with DeepSeek V4 - to coordinate multiple types of cybercrime. The actor operated with safety controls disabled in their AI tools.

Observed activities include:

• Credential Theft and Data Exfiltration: The actor utilized AI-generated reconnaissance to enumerate WordPress subdomains and REST APIs, leading to brute-force attacks and the successful exfiltration of a MongoDB database containing over 5,200 student and faculty records.
• VoIP Fraud Planning: The actor utilized AI bot profiles to acquire actionable knowledge on forming US-based LLCs, carrier access, and techniques for bypassing caller identity verification.
• Wi-Fi Password Cracking: The actor maintained automated pipelines to capture WPA authentication material from nearby access points for remote cracking.
• Cryptocurrency Reconnaissance: The actor scraped data on cryptocurrency holders for potential future targeting.

The investigation confirmed the actor's ability to execute these activities across diverse domains by leveraging AI as an expert advisor and task-automation tool.