Search — “BUGSTER”

A low-skill, English-speaking actor operating as BUGSTER configured the Hermes Agent framework with DeepSeek V4 and Cursor IDE, with safety controls disabled, to run WordPress brute force against an Indian university, exfiltrate a MongoDB database of over 5,200 records, plan VoIP fraud, crack Wi-Fi handshakes via cloud GPUs, and scrape cryptocurrency whale data. Hunters should look for hermes gateway processes started per profile, Telegram-controlled bot gateways, Cursor proxy environment variables that disable sandboxing, and traffic to 162.243.3[.]92. Unit 42 reports other actors adopting the same Hermes plus DeepSeek toolchain.