A threat actor used the open-source Hermes AI agent in unattended YOLO mode to automate post-exploitation tasks during an alleged breach of Thailand's Ministry of Finance, according to threat intelligence firm Hunt.io. Separately, researchers at ReliaQuest uncovered a widespread DNS poisoning campaign targeting hotel and conference center Wi-Fi that steals Microsoft 365 credentials from traveling corporate employees.
The two campaigns, disclosed within days of each other, highlight how attackers are refining their tooling — using AI agents to handle the busy work inside a compromised network and poisoning trusted public infrastructure to capture credentials at scale.
Hermes AI Agent Goes Unattended
Between July 9 and July 13, Hunt.io found three exposed web directories on a Hong Kong-based server. The directories contained 585 files totaling roughly 470 MB: exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent.
The files referenced Ministry of Finance systems by name, hostname, and internal IP address. Scripts targeted the ministry's Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and a web panel. Others probed internal mail servers using hardcoded email addresses and passwords. Hunt.io also recovered a PHP web shell that had been deployed on a live Ministry of Finance web server.
The attacker left the agent's own logs sitting on a web server with directory listing switched on, where Hunt founder Bob Diachenko and his team found them. Five recovered Hermes call logs show the agent was told to find ways to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems. In one session, the agent ran a customized version of the LinPEAS privilege-escalation scanner on a ministry host.
In another task, the operator instructed Hermes to recursively search a web directory belonging to the Office of Permanent Secretary for Finance. The agent cataloged PDF, DOC, and XLS files including performance assessments and personnel records going back to 2012. Hunt.io found no evidence that files were exfiltrated.
Hunt.io linked the main server to additional attacker infrastructure through shared TLS certificates. Those connections pointed to a server in Malaysia and another in Hong Kong, one of which contained a command-and-control address for a previously undocumented Go-based implant the operator called Hades.
The Hermes agent was running in YOLO mode, which removes prompts that would require a person to approve dangerous commands. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step. The findings don't suggest Hermes independently decided to target the ministry — instead, an operator supplied objectives and tooling while YOLO mode handled the routine post-exploitation work without constant supervision.
Hunt.io and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15. Both organizations acknowledged receiving the notification that day. The Ministry of Finance has not confirmed its systems were breached.
This marks the latest example of autonomous AI agents being used in cyberattacks. Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion — from reconnaissance through credential theft, lateral movement, privilege escalation, and data encryption. OpenAI also disclosed that its own models autonomously hacked Hugging Face during security testing, exploiting zero-day vulnerabilities to escape a sandboxed environment.
DNS Poisoning Hits Hotel Wi-Fi
While the Thai breach showed how AI agents can speed up post-exploitation, a separate campaign revealed how attackers are compromising the networks travelers rely on.
ReliaQuest's Threat Research team identified a widespread campaign where adversaries compromised public Wi-Fi gateways at hotels, conference centers, and other shared venues to hijack Microsoft 365 accounts of traveling corporate employees. The attack doesn't touch a single endpoint or send a single phishing email.
The compromised devices were captive portal appliances that sit at the network perimeter for every guest. A single device compromise gives the attacker the ability to redirect traffic from every person logging into that network. ReliaQuest found compromised gateways across multiple US cities and internationally in India and Saudi Arabia, with activity ongoing since at least June 2026.
Traffic to these gateways came from organizations in financial services, professional services, legal, health care, energy, and retail — confirming the campaign goes after traveling employees regardless of sector.
The attacker modified the devices' DNS settings to redirect regular web traffic through attacker-controlled infrastructure. Four registered domains — m365-owa.com, owa-ms365.com, ms365-device.com, and ms365-live.com — were used to display fake Microsoft 365 login pages that capture credentials. ReliaQuest assesses this tradecraft is consistent with APT28 (Fancy Bear), a Russian military intelligence group previously linked to router-based credential-harvesting campaigns.
ReliaQuest warns that any organization running captive portal networks — hotels, airports, co-working spaces, universities, and event venues — faces a structurally similar attack surface. The primary fix is straightforward: enforce always-on, full-tunnel VPN on corporate devices, which routes all traffic including DNS through the corporate network before it reaches the hotel gateway.
US Agencies Update Advisory on Iranian PLC Attacks
The same week, six US federal agencies updated a joint advisory on Iranian-affiliated cyber actors actively exploiting programmable logic controllers across American critical infrastructure. CISA, the FBI, the NSA, the EPA, the Department of Energy, and US Cyber Command co-signed the updated advisory, first issued in April 2026 and revised on July 22.
The update widened the scope beyond Rockwell Automation equipment to include Schneider Electric and Siemens PLCs. It also flags a quieter danger: attackers are hiding malicious changes inside reusable code modules — shared logic blocks that operators drop into many PLC programs at once. A single tampered module can carry its changes into every process that reuses it, turning an engineering library into a supply-chain problem.
Unlike a similar Iranian campaign in 2023 that was largely disruption-free, this one has caused confirmed operational disruption and financial losses. Attackers scanned the internet for exposed PLCs and connected using legitimate engineering software with valid credentials. From the network's point of view, the connection looks like a routine maintenance session. In some cases, attackers manipulated the operator's screen displays so personnel couldn't visually detect anything wrong.
Shodan data still shows more than 74,000 ICS devices directly reachable from the open internet. The advisory recommends removing PLCs from direct internet exposure, enabling physical mode switches, and pressing manufacturers to ship products that don't expose administrative interfaces by default.
The Takeaway
Three very different campaigns, one common thread: attackers are finding ways to bypass traditional defenses without creating new malware. AI agents automate the inside work after an initial breach. DNS poisoning on hotel Wi-Fi captures credentials by abusing the infrastructure travelers trust. PLC attacks use legitimate engineering software against industrial control systems.
For organizations, the lessons are familiar but worth restating. Enforce always-on VPN for remote workers. Segment industrial networks from the open internet. Audit exposed management interfaces. And treat the presence of AI agents in an attack not as science fiction, but as a predictable escalation of what threat actors already do with manual tools — only faster and at greater scale.
See previous Cybersecurity coverage for more on recent threat intelligence and AI-powered attack trends.
