How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Date: 10/26/2026

Severity: Critical

Summary

The threat actor BUGSTER used jailbroken AI tools, including the Hermes Agent framework powered by DeepSeek V4, to plan and execute multiple cybercrime activities, including credential theft, data exfiltration, VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control operations. The actor launched brute-force attacks against an Indian university and successfully compromised another university, exfiltrating more than 5,200 records containing students’ personally identifiable information (PII). The investigation highlights how accessible AI tools with disabled safety controls can help less-skilled attackers conduct cyberattacks, automate reconnaissance, and expand their criminal capabilities. 

Indicators of Compromise (IOC) List 

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:    

Threat Actor Uses AI to Execute Multiple Cybercrimes