Hermes AI Agent Attack: Autonomous Post-Exploitation Hits Thailand Ministry of Finance

Hermes AI agent is an open-source autonomous agent released in February 2026 that operates as a persistent service with memory between sessions. It accepts high-level objectives from its operator and then autonomously determines and executes the individual steps required to complete them, including running shell commands, interacting with APIs, and calling external tools.

YOLO mode is the critical enabler. With YOLO mode disabled, Hermes requires a human operator to approve each dangerous command before execution. A prompt appears before the agent runs anything with elevated risk: file traversal, privilege escalation scripts, credential access, or network scanning. With YOLO mode enabled, every one of those approvals is bypassed. The attacker supplies an objective, disconnects, and the agent works through the kill chain without any human present.

The Thailand attackers supplied Hermes with objectives targeting the Ministry of Finance's network and let the agent run. Five recovered Hermes call logs documented the autonomous execution chain: the agent ran LinPEAS, a Linux privilege escalation enumeration script, to assess kernel vulnerabilities and SUID/SGID binary paths; performed recursive file system searches targeting the Office of the Permanent Secretary; scanned for open service ports including Hadoop's HiveServer2, Ambari on port 10000, and GlassFish on port 4848; and tested mail infrastructure via SMTP AUTH password spraying with a word list.

This attack illustrates a capability shift: attackers no longer need to sit at a keyboard executing each post-exploitation command manually. Just as LLM-generated tooling has automated Active Directory attacks, autonomous AI agents have now removed the human from post-exploitation execution entirely, reducing intrusion operations to objective-setting and tooling deployment.

Hades is a custom backdoor compiled in Go that the attackers deployed on both Linux and Windows targets inside the Ministry of Finance network. The implant's command-and-control traffic uses HTTPS with URI paths that mimic legitimate web asset requests: /assets/app.min.js, /assets/vendor.js, and /assets/main.js. Without context, outbound HTTPS connections to those paths appear identical to a browser loading a web application's JavaScript files.

Traffic is encrypted with AES-256-GCM using keys hardcoded at build time, making decryption impossible without the implant binary. Hades includes operational security controls that distinguish it from commodity malware: a kill-date forces the implant to terminate after a configured date, and a working-hours schedule restricts C2 communication to defined time windows, both of which reduce dwell time in detection-sensitive periods.

On Windows, Hades supports ConPTY interactive shells, Registry Run key persistence, scheduled task creation, reflective PE loading into svchost.exe via process hollowing (T1055.012), and GDI-based screen capture. On Linux, the implant uses a standard PTY shell, cron-based persistence, shellcode execution, and SOCKS5 proxy support for pivoting deeper into the network.

The C2 servers used by Hades include 202.181.27.115 (Converged Communications Limited, Hong Kong), with the earliest certificate observed on June 26, 2026. The domain redhatupdating432.dnsrd.com resolved to the primary staging server at 43.246.208.207, using a name chosen to impersonate Red Hat package update infrastructure.

The Thailand Ministry of Finance breach is confirmed but has not been publicly acknowledged by the ministry. Hunt.io captured three open directories between July 9 and 13, 2026, totaling 585 files and 470 MB of attack infrastructure. The contents included Hermes session logs, VShell payload binaries for Linux and Windows, Hades implant binaries, a FOFA API key (a Chinese threat intelligence and reconnaissance platform), and a Hermes configuration file with the password "Leishen," the Chinese name for the Thunder God.

Attribution carries low-to-medium confidence that the operator is a Chinese-speaking threat actor or has intimate familiarity with Chinese-language tooling. The Hong Kong-hosted infrastructure overlaps with historical ShadowPad and VShell hosting patterns. Chinese-language artifacts appear across multiple recovered files. No threat actor group has been formally named or indicted.

Every organization running open-source AI agents, development environments, or AI testing infrastructure is now a direct target profile. Hermes is publicly available and installs in minutes. The 5,900 exposed Hermes panels Hunt.io found represent thousands of organizations already running accessible instances. An attacker who gains initial access to any environment can deploy Hermes as their autonomous post-exploitation engine. This follows the pattern established by AI agent attacks against enterprise SaaS platforms, where legitimate AI tooling gets repurposed to conduct attacks using the permissions of the authenticated context.

Hunt.io published the complete infrastructure list on July 24, 2026, after a 7-day responsible disclosure window. Block all four IP addresses at your firewall and proxy egress controls now. The redhatupdating432.dnsrd.com domain uses a Red Hat name impersonation to blend with legitimate update traffic and should be blocked at DNS across all resolvers in your environment.

No CVE-specific Sigma rule exists for Hermes AI agent attacks: the tool is a post-exploitation framework rather than a specific vulnerability, so detection targets the behavioral patterns it produces rather than exploit signatures. The three rules below cover the specific behaviors documented in the Thailand Finance Ministry breach: webshell spawning shell utilities from Linux web server processes, systematic Linux privilege escalation enumeration, and tool reconnaissance from web application servers on Windows.

All three rules require process creation telemetry from an endpoint agent. For Linux targets, auditd or a kernel-level agent such as Falco is required. The Linux Webshell Indicators rule monitors for Apache, Nginx, and Tomcat processes spawning utilities like whoami, ifconfig, or ip, which directly matches the post-shell-deployment Hermes behavior documented in this incident.

WAF rules below target the PHP webshell access pattern and the known Hermes campaign C2 IPs. Deploy all WAF rules in Count or Log mode for 24 hours to baseline false positives before switching to enforcement.

Seven controls close the exposure documented in the Thailand Finance Ministry breach. Execute steps 1 and 2 immediately. Steps 3 through 7 require endpoint and network changes that may take 24 to 48 hours.

The Hermes AI agent attack on Thailand's Ministry of Finance is not a proof-of-concept or a research demonstration. It is a confirmed operational breach of a government institution using an open-source AI tool any attacker can download and configure in minutes.

The capability demonstrated here is a qualitative change in attacker economics. Multi-stage post-exploitation previously required skilled operators who could execute dozens of commands, interpret results, adjust tactics, and maintain situational awareness across a breach. Hermes AI agent in YOLO mode reduces that requirement to a single high-level objective and a start command. The human bottleneck in the intrusion kill chain is gone.

The 27 published CVEs in Hermes's first 75 days, the 5,900 exposed panels, and the confirmed government breach together show this is not an edge case. AI agent tooling is now part of the operational threat actor toolkit, and the barrier to deploying it equals installing any other open-source package.

Your exposure is not limited to environments where you have deployed Hermes yourself. Any attacker who gains initial access can deploy it as their autonomous post-exploitation engine. Any exposed Hermes Web UI can be seized before your team discovers it. The IOCs, Sigma rules, and WAF configurations in this post are your immediate response layer. Apply them now.