Loading story…
Researchers reported an active espionage intrusion targeting Thailand’s Ministry of Finance, tied to exposed attacker infrastructure at 43.246.208[.]207 and additional linked hosts in Hong Kong and Malaysia. The operation used the open-source Hermes autonomous AI agent in unattended "YOLO" mode to enumerate ministry systems, map internal services, and assess privilege-escalation paths, while a previously undocumented cross-platform Go implant dubbed Hades was staged to maintain persistence on both Windows and Linux systems. Investigators also linked a VShell C2 server and the domain redhatupdating432.dnsrd.com to the activity.
Recovered artifacts showed targeting of ministry administrative panels, mail infrastructure, Apache Hadoop and HiveServer2 environments, Apache Ambari, GlassFish, Alfresco, and internal document systems. The exposed directories contained exploit code, web shells, stolen credentials, credential-testing scripts, and Linux and IIS exploitation or privilege-escalation modules, while Hades reportedly supported command and control, file transfer, proxying, and screen capture. Investigators said the evidence indicates compromised internal access, though no data exfiltration had been confirmed at publication time, and assessed with low-to-moderate confidence that the operator was a Chinese-speaking or Sinophone threat actor based on infrastructure history, Chinese-language indicators, and use of FOFA.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-30, Unit 42 published an investigation describing a Chinese-speaking threat actor using DeepSeek via the Hermes Agent framework and Telegram to autonomously enumerate targets, identify vulnerabilities, and attempt exploitation. The report also disclosed confirmed successful exploitations against Citrix NetScaler, Marimo notebook, Apache Tomcat, and Windows IKE VPN targets, including persistent targeting of a Malaysian government entity, after the operation was exposed by an accidentally opened HTTP file server.
The published investigation assessed with low-to-moderate confidence that the operation was conducted by a Chinese-speaking or Sinophone threat actor. The assessment was based on infrastructure history, Chinese-language indicators, ShadowPad-related infrastructure history, and use of FOFA.
On 2026-07-23, Hunt.io and researcher Bob Diachenko published a technical investigation describing the ongoing operation. The report tied exposed staging infrastructure on 43.246.208.207, additional linked hosts, a VShell C2 server, and the domain redhatupdating432.dnsrd.com to the activity.
The investigation identified a previously undocumented cross-platform Go implant called Hades that provided persistence and command-and-control capabilities on Windows and Linux hosts. Reported functions included file transfer, proxying, and screen capture.
Recovered logs and scripts showed the operators used the open-source Hermes autonomous AI agent in unattended "YOLO" mode to enumerate the ministry network and assess privilege-escalation paths. The tooling was used against exposed ministry-facing services during the intrusion.
Researchers documented an ongoing espionage intrusion targeting Thailand's Ministry of Finance in July 2026. Artifacts indicated compromised access to multiple internal systems, including administrative panels, mail infrastructure, Hadoop/HiveServer2, Ambari, GlassFish, and document systems.
Hunt.io and Bob Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency about the suspected intrusion affecting Thailand's Ministry of Finance. According to the report, both organizations acknowledged receipt on the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcemeetcyber.net
Open sourcedarkreading.com
Open sourcetherecord.media
Open sourcehunt.io
Open sourcecyberveille.ch
Open sourcehermes-agent.org
Open sourcecode.claude.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor used an AI-enabled offensive workflow built around **Hermes Agent** and the **DeepSeek** model to autonomously scan the internet, identify vulnerable systems, evaluate exploit paths, and launch attacks against exposed services. The activity initially targeted **Langflow** instances and later shifted to **n8n** servers after unsuccessful exploitation attempts, showing a repeatable machine-driven cycle of reconnaissance, exploit research, and attack execution with limited human intervention. Researchers said the campaign did not achieve full compromise through the autonomous workflow alone, but the same actor also conducted manual intrusions that successfully exploited **Citrix NetScaler** devices, obtained command execution on **Marimo** notebook instances, and attempted reverse-shell access against **Apache Tomcat** and VPN targets. Unit 42 gained rare visibility into the operation after Hermes accidentally exposed the operator’s home directory through a public HTTP file server, revealing scripts, target lists, API settings, shell history, and autonomous session logs that showed AI-assisted cyberattacks are already operationally viable against internet-facing infrastructure.
Aug 4, 2026
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026
ESET attributed a targeted supply-chain attack to **OceanLotus** (`APT32`), saying the Vietnam-aligned espionage group compromised the update server for **FireAnt MetaKit**, a software component used by Vietnamese stock investors, and pushed malicious updates between October 2025 and March 2026. The tampered updates delivered a downloader that used DLL side-loading to install the **SPECTRALVIPER** backdoor, with researchers saying the operation was selective rather than a broad mass infection campaign. FireAnt MetaKit’s update process reportedly lacked integrity checks and TLS protection, allowing attackers to replace legitimate packages and abuse the trusted update channel. Researchers said the malware used HTTPS for command-and-control, injected into `OneDrive.Sync.Service.exe`, and relied on infrastructure including `financemachinelearning[.]com`, while a parallel OceanLotus intrusion hit an unnamed Vietnamese infrastructure and transport construction company after suspected exploitation of remote code execution flaws in a public-facing Microsoft SQL Server. Multiple SPECTRALVIPER variants were then used for persistence, profiling, and lateral movement. The campaigns indicate a sharper OceanLotus focus on domestic Vietnamese surveillance, including targets tied to finance, infrastructure, and potentially politically sensitive anti-corruption and market investigations.
Jun 29, 2026