“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

The threat actor, operating under the handle BUGSTER, weaponized AI assistants with disabled safety controls, specifically using the Hermes Agent framework combined with DeepSeek V4 and Cursor IDE, to conduct a range of cybercriminal operations. These included methodical reconnaissance and brute force attacks against Indian university websites, resulting in the exfiltration of a MongoDB database containing over 5,200 records with personally identifiable information. The actor also enumerated e-commerce platform data and developed VoIP fraud infrastructure with AI-generated technical knowledge. The AI tools generated structured reconnaissance reports and attack plans, including a 'NEXT EXPLOIT OPPORTUNITIES' section outlining future attacks. The actor's activities demonstrate how AI lowers the skill barrier for complex cybercrime, with multiple independent actors adopting similar AI toolchains.

The actor successfully compromised multiple Indian organizations, including universities, resulting in the theft of thousands of personal records containing sensitive information. The attacks exposed cloud infrastructure components and third-party cloud storage accounts. The actor's AI-assisted operations enabled credential theft, data exfiltration, and the planning of VoIP fraud and other cybercrimes. The use of AI tools with disabled safety controls facilitated more efficient and scalable attacks, increasing the potential impact and reach of these criminal activities.

No official patch or fix applies as this is a threat actor's operational methodology rather than a software vulnerability. Organizations should leverage advanced security solutions such as Palo Alto Networks' Advanced URL Filtering, Advanced IP Defense, Cortex XDR, XSIAM, and Agentic Endpoint Security to detect and block AI-enabled attack techniques. Identity and access management tools like Idira PAM, IAM, and Secrets Manager can help protect credentials and secrets. Engaging with threat intelligence services and incident response teams, such as Unit 42, is recommended for tailored detection and mitigation of AI-enabled threats. Monitoring for AI-generated reconnaissance patterns and brute force attempts on WordPress and other platforms is advised.