Hermes AI Attacks Thai Ministry of Finance: Hades Implant Found

Researchers have uncovered an intrusion targeting Thailand’s Ministry of Finance. This operation used an autonomous AI agent called Hermes, running unattended. The AI agent, Hermes, operated in "YOLO" mode, meaning it executed commands automatically without human approval. Logs show Hermes performing privilege escalation checks, file enumeration, and reconnaissance across ministry systems. The investigation also found a new implant called Hades. This custom malware supports encrypted communications, file transfers, and interactive shells. It even includes operational safeguards like configurable working hours. This discovery offers a rare look inside a live cyber-espionage operation, as researchers found exposed staging servers with attack tools and stolen credentials. The findings suggest the operation was still unfolding. This incident highlights how advanced AI agents are now being used in cyberattacks, changing the landscape of cyber security.