Hermes Agent Ran Unattended Against Thailand's Finance Ministry, and Its Logs Were Left Online

Between 9 and 13 July 2026, the threat-intelligence firm Hunt.io and researcher Bob Diachenko found three open directories on a Hong Kong staging server belonging to an intrusion against Thailand's Ministry of Finance. The 585 files and 470 MB of material included the logs of Hermes Agent, the open-source agent framework from Nous Research, run in "YOLO" mode with the human-approval step switched off. Unattended, it ran LinPEAS privilege checks, enumerated SUID binaries and recursively crawled a web root belonging to the Office of the Permanent Secretary for Finance, cataloguing personnel records dating back to 2012. The same host carried a previously unreported Go implant the operator called Hades. Hunt.io found no evidence files were taken and could not establish how the intruders first got in. The full entry, dated 30 July 2026 and graded confidence A, sits in the AI incident archive beside the other agent-driven intrusion records in this series.

The directories were on 43.246.208[.]207, a host on AS132883 (TOPIDC) in Hong Kong, and Hunt.io's Attack Capture archived them on 9, 10 and 13 July: 145 files, then 62, then 378, for 585 in total. The IP had a documented history as a ShadowPad controller and was running a VShell command-and-control server on port 21083 when Hunt.io looked. The researchers say they have "no evidence confirming or denying" that VShell was used against the ministry. The archive dates the record 30 July 2026; the research behind it is older, published by Hunt.io on 23 July after a seven-day disclosure window, and reported by The Record on 27 July and Dark Reading on 28 July.

The agent's five call logs

Inside the 9 July directory was a folder named hermes-results containing five files, each named call_00_ followed by a random string. Hunt.io describes them as records of the agent's own calls and summarises what each returned. The first is a privilege-escalation assessment and kernel vulnerability scan against a ministry host. The second is a second LinPEAS run, enumerating services. The third enumerates SUID and SGID binaries with find. The fourth lists containers and filesystems and is punctuated by broken-pipe errors, which Hunt.io reads as the agent producing more output than the server could carry. The fifth is the one that matters most: a recursive search of the web root connected to the Permanent Secretary's office, which held standard Office documents, performance evaluation forms and personnel records dating back to 2012.

None of that needed a person at the keyboard. Hunt.io says the operator ran Hermes Agent "in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." The framework, released in February 2026, runs as a persistent daemon and keeps memory across sessions; YOLO is the option that removes the prompts. Hunt.io reports that the project had passed 140,000 GitHub stars by July 2026. The Cloud Security Alliance's analysis of the logs describes an agent evaluating each result and selecting the next step — a workflow that, from the outside, resembles how a human analyst would proceed, at machine pace.

Hunt.io is careful about what the logs establish. The web-root crawl shows the agent reaching personnel files; it does not show them leaving. "There is no evidence the files were exfiltrated," the report says. Its summary of the whole server is that the files "describe an intrusion still running: tooling staged, internal access expanding, and no sign data had left the network, though the operator was clearly cataloguing web content."

The work the human still did

The division of labour is the most useful thing in the report. The agent handled generic, repeatable reconnaissance — work that can be scripted and needs no knowledge of the target. The operator supplied what the agent could not know: a password wordlist built from abbreviations of the ministry's interior departments and programmes, internal hostnames, non-routable addresses, and scripts written around specific services. The Cloud Security Alliance's research note, published on 26 July, makes the same point: the human retained "target-specific tradecraft" while the agent ran the parts that scale.

The clearest example is the Hadoop chain. The 13 July directory held more than a dozen files aimed at Apache HiveServer2, including hive_rce_py2.py, which opens a raw socket to an internal node on port 10000 and authenticates with SASL PLAIN. HiveServer2's default authentication mode is NONE, which accepts any credentials without validating them, and the script was written to rely on exactly that. It then registers a malicious Java user-defined function packaged as HiveCmd.jar and passes shell commands through Hive SQL, retrieving output over WebHDFS from a second internal node on port 50070. A separate Ambari payload names an internal HDFS DataNode by hostname, going after the management layer rather than the data.

The rest of the toolkit follows the same pattern of preparation. Node.js scripts prefixed gf_ drive a headless Chrome instance through a SOCKS5 proxy to reach an internal GlassFish admin console, log in with default credentials and deploy a WAR file; Hunt.io could not confirm that either WAR was deployed. A PHP web shell disguised as a journal cache file was placed at /storage/Counter/nine/.journald-cache.php on a ministry web server. A Perl script, mail4.pl, tests SMTP authentication against ministry mail infrastructure with hardcoded mailbox addresses and passwords built from the extracted tokens; Python scripts named mail_test.py and mail3.py do the same. A text file, alf_cookie.txt, holds Alfresco session material for an internal ministry address. Both directories also hold exploit code for CVE-2021-3156, the sudo heap overflow, CVE-2021-4034, PwnKit, and CVE-2017-7269, the IIS 6.0 WebDAV overflow, along with shellcode and paths pointing at the ministry's intranet.

Nothing here is novel tradecraft. What the logs add is that the enumeration ran continuously, without the pauses a human operator leaves between commands — the Cloud Security Alliance note argues that detection built around keyboard-paced activity is poorly matched to it.

Hades, staged but not confirmed running

The 10 July directory was a delivery server: 62 compiled Go binaries, Windows PE and Linux ELF, many named after legitimate system processes — ctfmon, csrss, conhost and MicrosoftEdgeUpdate on Windows; kworker, multipathd and accounts-daemon on Linux. Two carry the project's name, hades_linux_amd64 and hades_windows_amd64. Hunt.io analysed one sample from each platform and found they came from the same codebase; the other 60 share the same size range and build characteristics but were not individually examined.

Static and dynamic analysis found HTTPS command-and-control disguised as static web assets: /assets/app.min.js for check-in, /assets/vendor.js for tasking, /assets/main.js for upload. Payloads are encrypted with AES-256-GCM under a hardcoded per-build key. Environment variables include a kill date, HADES_KILLDATE, and a working-hours schedule that makes the implant sleep outside a configured window. The Windows build persists through a Registry Run key and a scheduled task, executes in memory by reflective loading into a hollowed svchost.exe, captures screenshots through GDI and offers a SOCKS proxy; the Linux build uses a cron job, a standard PTY and shellcode execution. Both support chunked, resumable file transfer.

The two analysed samples pointed at different controllers: the Windows executable dwm_33b7.exe beacons to the staging server on port 443, and the Linux binary multipathd_04d0 to 202.181.27[.]115 on port 12443 — the host found through the shared certificate fingerprint. Hunt.io notes that the naming may be coincidental: in Greek myth, Hermes guides souls to Hades.

What no source establishes is Hades running inside the ministry. Hunt.io recovered the binaries from the operator's own server. The Cloud Security Alliance note says no recovered artefact shows Hades reaching a ministry machine, and Dark Reading reports that the research did not specify where it was deployed. The implant is a capability the operator had built and staged, not a confirmed resident on a ministry host.

Who was behind it

Hunt.io did not name a group. It assessed, at low-to-medium confidence, that the operator is Chinese-speaking or intimately familiar with the language, on four indicators: the host's history as a ShadowPad controller, Hong Kong infrastructure, a Hermes web-interface password containing the Chinese word "Leishen", meaning thunder god, and an API key for FOFA, a Chinese internet asset-reconnaissance service. An environment snapshot also records the SSH client 103.97.0[.]57, on AS133073 (HK Kwaifong Group Limited), connecting to the staging server. None of that is attribution to a state or a named cluster, and Hunt.io says as much.

Two things about the intrusion itself remain unknown. The initial access path is one: "The method of initial access remains unknown," the report concludes. The other is scope. Hunt.io says active session cookies, deployed web shells and internal network access indicate the operator "was able to compromise multiple systems within the MOF network", but it also warns that the cookie values alone do not prove a login, because Laravel issues session and CSRF tokens to any visitor. The compromise is an assessment built from artefacts, not a confirmed inventory of hosts.

What Thailand did next

Hunt.io says it and Diachenko notified Thailand's national CERT and the National Cyber Security Agency on 15 July 2026, and that both acknowledged receipt the same day; publication was then held for a seven-day window. No public ThaiCERT advisory referring to the ministry was found in the coverage reviewed for this article.

On 27 July, the day The Record reported the intrusion, Thailand's National Cyber Security Committee held its second meeting of 2026 and approved measures aimed at AI-agent threats. The agency's own account says the committee assigned ThaiCERT to monitor, analyse and track AI-agent threats, warn agencies at risk and support incident response and digital forensics; tasked sectoral CERTs with tightening checks and reporting; and endorsed proactive steps including checks of internet-facing systems, management of privileged accounts, network segmentation, backups and recovery testing. It also directed guidelines for safe, transparent and auditable use of AI agents inside organisations, and joint exercises by ThaiCERT and the sectoral CERTs simulating AI-agent attacks. The post does not name the Ministry of Finance or Hunt.io, and The Record noted that officials "did not directly reference the Hunt.io investigation" while judging the measures apparently aimed at the threat. Any causal link between the meeting and this intrusion is an inference, not a statement by the agency.

Theerawut Wittayakorn, deputy secretary-general of the National Cyber Security Committee, said after the meeting that Thailand "must be able to fully benefit from AI while systematically managing the associated risks", The Record reported. The Ministry of Finance itself stayed silent: The Record reported on 27 July that the ministry had not publicly acknowledged the incident and did not respond to a request for comment, and Dark Reading reported the next day that the government had not commented. The archive's entry, dated 30 July, records the same.

What is established, what is assessed, what is missing

The archive classifies the entry as a realised incident, severity critical, confidence A, undisputed, with real harm recorded and the type tag WEAPON; it is not marked a landmark. The confidence grade describes the documentation, and the documentation is unusually direct: Hunt.io archived the operators' staging server, not a victim's logs. It does not describe independent verification, and on that point the record is thin.

• Established: three open directories on one host between 9 and 13 July, holding 585 files and 470 MB; five Hermes call logs showing LinPEAS, SUID enumeration, container listing and the web-root crawl; Hermes Agent running in YOLO mode; 62 Go binaries including Hades; the HiveServer2 script and its UDF; the web-shell path; credential and session material; no evidence of exfiltration; Hunt.io's notification to ThaiCERT and NCSA on 15 July, acknowledged the same day.

• Assessed: that the operator is Chinese-speaking, at low-to-medium confidence; that multiple ministry systems were compromised; that the NCSA measures of 27 July were a response to this intrusion.

• Missing: the initial access path; how many hosts or records the operator reached; whether any file left the network; any ministry confirmation; any public ThaiCERT advisory; any independent forensic examination.

One secondary account went further than the primary report. iThome's Chinese-language security digest for 27 July, summarising the same Hunt.io research, states that the intruders entered through a PHP web shell on an internet-facing ministry server and that the environment contained at least 47 hosts, 54.9 TB of government financial data, 14 Microsoft SQL databases, biometric systems and a remote-desktop gateway. None of those figures appears in Hunt.io's report, which says the method of initial access remains unknown, and the archive's record follows the report. Readers who have seen the larger numbers should treat them as unsupported by the primary source.

Independent reporting exists, but independent evidence does not. The Record (27 July), Dark Reading (28 July) and the Cloud Security Alliance (26 July) all draw on Hunt.io's data; none describes its own forensic examination, victim access or sample analysis. Dark Reading adds an interview with Hunt.io's head of research, Esteban Borges, who says the firm found no evidence of exfiltration and that the AI-heavy operations he has seen leave more behind, not less. The Record adds the NCSA statement. The CSA note adds analysis, and one useful caution: no recovered artefact shows Hades on a ministry machine. Beyond those additions, the incident facts in the coverage trace to the same primary report.

What defenders were told

Hunt.io's recommendations address the parts with clear fixes. Review the HiveServer2 authentication mode and enforce the UDF blocklist; audit web roots recursively for PHP files with leading-dot names that imitate system caches; patch sudo to 1.9.5p2 or later and check polkit versions against CVE-2021-4034; disable WebDAV on any remaining IIS 6.0 instance or move off the platform; alert on web-server processes opening outbound connections to internal ports such as 10000 or 50070; and change default credentials on GlassFish admin consoles, restricting access to trusted networks. For organisations running agent frameworks, the Cloud Security Alliance adds a control that would have mattered here: audit whether an unattended or YOLO-equivalent mode is enabled anywhere, and disable it unless there is a logged, risk-accepted reason.

Hunt.io also turned the incident into a way of finding other exposed panels. The Hermes web interface, it says, returns a distinctive Server header and Basic-auth realm, and a banner query for HermesWebUI returned about 5,900 events in the previous month; a search for open directories containing the agent's /hermes-results/ path returned 575 hits. Those are counts from one vendor's dataset at publication, not a count of victims, and they move as panels appear and disappear. The useful part is the indicator: exposed agent panels and their output directories are discoverable, which is how this operation came to light.

The archive does not mark the entry a landmark, and the technical record supports the restraint. LinPEAS, Hive UDF abuse, default credentials and a public exploit from 2017 are old tools; what is new is the staffing — an agent doing the enumeration continuously, and an operator doing the target-specific preparation. That two-part arrangement is what the logs document. What they cannot document is impact: how far into the ministry the operator got, what the personnel files contained, or whether anything left the network. Until the ministry or an independent investigator answers those questions, the record describes a well-documented intrusion whose cost is still unknown.