Hermes AI Agent Used to Automate Attack on Thai Ministry of Finance

In an intrusion targeting the Thailand Ministry of Finance, threat actors relied on the open-source Hermes AI agent to handle post-exploitation activities in an unattended execution mode. Rather than manually issuing commands or executing static scripts after gaining an initial foothold, the attackers deployed the agentic AI framework to dynamically discover assets, execute command-line instructions, and navigate internal networks without direct human supervision.

Autonomous Post-Exploitation in the Wild

The deployment highlights a operational transition from script-assisted hacking to fully autonomous cyber operations. The Hermes AI agent is an open-source framework designed to interact with command-line interfaces, execute terminal commands, analyze system output, and decide subsequent actions based on natural language task prompts.

During the breach, the threat actors enabled the framework’s unattended mode—frequently referred to in developer documentation as “YOLO mode”—which bypasses human-in-the-loop approval prompts before running terminal commands. Once executed on a host within the Ministry of Finance environment, the agent dynamically executed shell commands, evaluated return codes, handled error conditions, and pivoted across internal system structures without waiting for manual operator feedback.

Operational Advantages for Adversaries

Deploying agentic AI frameworks in post-exploitation scenarios solves a primary bottleneck for attackers: operational throughput. Standard post-exploitation frameworks like Cobalt Strike or PowerShell Empire rely on pre-written scripts or manual operator input over a command-and-control (C2) channel.

By contrast, an autonomous agent equipped with local model context or remote LLM API access can adapt instantly to unfamiliar environment configurations:

• Dynamic Scripting: The agent writes, tests, and modifies execution scripts on the fly based on specific operating system responses and environment variables.
• Contextual Log Clearing: Rather than executing standardized log-wiping scripts that generate predictable telemetry, an agent can review local logging mechanisms and clear or alter audit logs selectively.
• Non-Deterministic Traffic Patterns: Command timing and command variations adapt fluidly to system responses, complicating standard signature-based detection mechanisms that rely on fixed beaconing or repeated CLI parameters.

Defensive Challenges and Countermeasures

Detecting autonomous AI agents requires monitoring execution behaviors rather than looking for static malware signatures. Because the Hermes AI agent utilizes standard administrative command-line utilities (such as cmd.exe, PowerShell, bash, or native system discovery tools), traditional antivirus solutions may treat the underlying activity as legitimate administrative behavior.

Organizations aiming to defend against AI-driven post-exploitation should implement the following targeted controls:

1. Restrict Agentic Tool Permissions: Ensure any local AI models, developer agents, or language model interfaces operate within restricted sandboxes without process elevation permissions or raw terminal socket access.
2. Behavioral CLI Anomaly Detection: Deploy endpoint detection and response (EDR) rules targeting rapid, multi-step subshell creations where a single parent process issues sequential discovery, network mapping, and privilege escalation commands in an unusually compressed timeframe.
3. API Key Monitoring and Scoping: Audit network egress for connections to public LLM API endpoints or unauthorized C2 infrastructure delivering model payloads, and restrict corporate API keys to dedicated, monitored jump hosts.