{
  "name": "Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged",
  "slug": "thailands-ministry-of-finance-targeted-with-hermes-ai-agent-running-unattended-hades-implant-staged",
  "description": "Between July 9-13, 2026, three exposed directories on a Hong Kong server revealed an ongoing cyber espionage operation targeting Thailand's Ministry of Finance. The attack leveraged Hermes, an autonomous AI agent operating in unattended YOLO mode, alongside a custom Go-based implant called Hades. Recovered files included exploit code for multiple vulnerabilities, webshells, stolen credentials, and purpose-built scripts targeting MOF Hadoop infrastructure, mail systems, and GlassFish consoles. The AI agent autonomously enumerated ministry networks using LinPEAS, traversed files, and assessed privilege escalation paths. Infrastructure analysis linked multiple Hong Kong and Malaysian servers through TLS certificates and hardcoded C2 addresses. Chinese-language indicators and historical ShadowPad/VShell presence suggest probable Chinese-speaking attribution, though initial access methods remain undetermined.",
  "published": "2026-07-23T20:59:18.550000+00:00",
  "created_at": "2026-07-23T23:50:55.873000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "apache hadoop targeting",
    "autonomous attack operations",
    "cve-2017-7269",
    "cve-2021-3156",
    "cve-2021-4034",
    "cve-2026-31431",
    "cve-2026-43284",
    "cve-2026-43500",
    "cve-2026-43503",
    "government espionage",
    "hades",
    "hades implant",
    "hermes ai agent",
    "hiveserver2 exploitation",
    "shadowpad",
    "suo5",
    "thailand ministry finance",
    "vshell",
    "yolo mode"
  ],
  "tags": [],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "4d28e30b-0701-4fa8-9e50-cc3b0a005987",
        "name": "CVE-2026-43500"
      },
      {
        "id": "f7736cb8-c434-4ed9-b39e-829b0dfa4870",
        "name": "CVE-2026-43284"
      },
      {
        "id": "eb4fc06b-9778-44f6-ac98-f8a94480ecd9",
        "name": "CVE-2021-3156"
      },
      {
        "id": "0359acc0-2b2f-4ea9-9ab4-5ea41898ed5c",
        "name": "CVE-2026-43503"
      },
      {
        "id": "1c37b7a1-618e-4c58-847b-10e99a9078b4",
        "name": "CVE-2026-31431"
      },
      {
        "id": "96667a75-71ff-4d5f-b850-2873b5a3c99f",
        "name": "CVE-2021-4034"
      },
      {
        "id": "16a21a32-8015-419e-8a9a-6d23a96288e6",
        "name": "CVE-2017-7269"
      }
    ],
    "indicators": [
      {
        "id": "f0838bdc-9508-4cc5-961a-7ec6c49f4eae",
        "name": "d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2"
      },
      {
        "id": "6e187f18-b562-44d1-bc3b-2412993d7f19",
        "name": "mail4.pl"
      },
      {
        "id": "9abe6bc5-d9ae-45ff-a0c7-dcea70916b54",
        "name": "43.246.208.207"
      },
      {
        "id": "e9f01981-e624-4aef-ac0c-0955c00515e7",
        "name": "103.97.0.57"
      },
      {
        "id": "7e3c5542-0bf4-4388-96a1-8deecf61b66b",
        "name": "ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2"
      },
      {
        "id": "e369fd32-128c-4081-b31d-a7f99e2fb55f",
        "name": "b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53"
      },
      {
        "id": "75250657-742a-43c2-9e70-42a0551b2c0a",
        "name": "0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc"
      },
      {
        "id": "6df8d365-1470-48f1-a4ed-0ddf749d32a0",
        "name": "2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d"
      },
      {
        "id": "17aa8e60-dba3-4c73-92ce-c63bc01760e8",
        "name": "dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123b"
      },
      {
        "id": "ea632d01-9ff3-42d2-bd18-dbd6aad86d9a",
        "name": "ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81"
      },
      {
        "id": "3059e0e0-7464-48cf-b085-6aaf1330d66a",
        "name": "9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aa"
      },
      {
        "id": "1c9cceaf-ff6e-4e9a-81ff-4613be16226d",
        "name": "5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753"
      },
      {
        "id": "c34bd7eb-84e5-4263-b691-4b876261bd71",
        "name": "redhatupdating432.dnsrd.com"
      },
      {
        "id": "41013b07-cfc5-4e24-a6bc-3ba508255034",
        "name": "202.181.27.115"
      },
      {
        "id": "a9e929d9-1ab0-43d0-9805-d06b9063cbf1",
        "name": "576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e49"
      },
      {
        "id": "ebe3616f-20c7-4364-9124-af2103cd6956",
        "name": "58338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a"
      },
      {
        "id": "75218d73-02de-4f5d-9a1d-28d4471eee73",
        "name": "a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "4ad07171-7f93-428f-85e3-c2470aeb1278",
        "name": "T1110.003"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "36d26fbc-439e-460e-bb28-0935ad0c1b8a",
        "name": "T1090.001"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "6a495275-5433-4b64-90e5-18b9f07296da",
        "name": "T1072"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "c97eecb2-46dd-4e3b-8b82-906269d7cb83",
        "name": "Hades",
        "slug": "hades"
      },
      {
        "id": "6eb1e541-4ae8-42dd-87c4-197534c82ca3",
        "name": "ShadowPad - S0596",
        "slug": "shadowpad-s0596"
      },
      {
        "id": "85ab906f-5034-44be-b872-ebfe4a94716e",
        "name": "POISONPLUG.SHADOW",
        "slug": "poisonplugshadow"
      },
      {
        "id": "48bf86f1-ad36-4756-9b5a-5ecae40d64fc",
        "name": "suo5"
      },
      {
        "id": "c400feab-a609-418e-b2ec-da945eec6bbe",
        "name": "VShell",
        "slug": "vshell"
      }
    ],
    "observables": [
      {
        "id": "b184e342-4c1e-40d3-9b4f-a55c9c3d040d",
        "name": "mail4.pl"
      },
      {
        "id": "61db4ee0-2c06-4d90-a525-1f8068053ad3",
        "name": "redhatupdating432.dnsrd.com"
      },
      {
        "id": "1f80a6fe-67a4-4885-82f1-37ea0853025f",
        "name": "103.97.0.57"
      },
      {
        "id": "19629d75-99b9-4c47-aba9-6f947ba3b9e9",
        "name": "202.181.27.115"
      },
      {
        "id": "1c40e368-e66d-43fc-b78c-942d95cca294",
        "name": "43.246.208.207"
      }
    ]
  },
  "external_refs": [
    {
      "id": "dd0eb185-60c5-48ff-999d-ba6460e51f0c",
      "standard_id": "external-reference--17d4fcaa-6354-5ff4-83e2-6b552578db12",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent",
      "hash": null,
      "external_id": null,
      "created": "2026-07-23T23:50:46.345Z",
      "modified": "2026-07-23T23:50:46.345Z",
      "createdById": null
    },
    {
      "id": "290d969a-0047-4aa0-8637-eff65cddc2cc",
      "standard_id": "external-reference--fd4aea2d-65a5-519d-8bb0-33a35b63b5b6",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a6280a6b0f220d5330af106",
      "hash": null,
      "external_id": "6a6280a6b0f220d5330af106",
      "created": "2026-07-23T23:50:46.317Z",
      "modified": "2026-07-23T23:50:46.317Z",
      "createdById": null
    }
  ]
}