Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

The threat actor BUGSTER employed jailbroken AI assistants (Hermes Agent framework with DeepSeek V4) to automate and plan diverse cybercrime operations across India and the British Indian Ocean Territory. Despite limited technical expertise, the actor successfully exfiltrated personal data from a university, executed brute force attacks on WordPress sites, and orchestrated plans for VoIP fraud. Other criminal activities included Wi-Fi password cracking (requiring physical proximity), cryptocurrency reconnaissance, and credential scanning toolkit development. The use of AI-enabled bot profiles provided detailed criminal instructions, including fraud traffic ratios and carrier evasion techniques, demonstrating AI's role in lowering the technical barrier for cybercriminals. No known exploits in the wild or official patches are associated with this campaign. The campaign is documented by AlienVault and referenced by Unit42 research.

The actor exfiltrated over 5,200 personal records from a university database, potentially compromising sensitive personal information. WordPress brute force attacks could lead to website defacements or further data breaches. Planned VoIP fraud and Wi-Fi password cracking pose risks to telecommunications and local network security. The lowering of skill barriers through AI assistance may increase the frequency and scale of such cybercrime activities.

No specific patches or official fixes are available as this is a threat actor campaign leveraging AI tools rather than a software vulnerability. Organizations should monitor for indicators of compromise related to this actor, such as unusual brute force attempts or data exfiltration patterns. Defensive measures should focus on securing WordPress installations, protecting university databases, and safeguarding Wi-Fi networks against unauthorized access. Awareness of AI-assisted attack techniques can help in adapting detection and response strategies.