Hunt.io recovered five Hermes task logs from an exposed server used in activity associated with systems at Thailand’s Ministry of Finance. The logs record service discovery, privilege checks, filesystem inspection and file enumeration while the open-source agent was running in its unattended, or “YOLO,” mode.
The ministry has not publicly confirmed the reported compromise, and Hunt.io could not determine how the operator gained initial access. The researchers notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15; both acknowledged the notice that day, according to the report.
Those limits are important. The exposed server held working material from an intrusion, but a file found in a staging directory is not proof that every tool was deployed. The Hermes logs provide the clearest record of what actually ran.
Five logs captured the agent’s work
Hunt.io found three open directories on a Hong Kong-hosted server between July 9 and July 13. The directories contained 585 files totaling about 470 MB, including exploit code, web shells, tunneling tools, custom scripts, credentials, session data, Windows and Linux payloads, and Hermes output.
The hermes-results directory held five call logs. One recorded a privilege-escalation assessment and kernel checks. A second contained service discovery from a customized LinPEAS run. The remaining logs covered SUID and SGID searches, container and filesystem inspection, and a recursive search of a web directory associated with the Office of the Permanent Secretary for Finance.
That recursive search inventoried PDF, DOC and XLS files, personnel records, and performance material dating to 2012. Hunt.io found no evidence that the files were exfiltrated. Another log contained broken-pipe errors after the agent produced more output than the receiving service could process.
Hermes did not select the ministry or establish access on its own. The recovered configuration showed that an operator had enabled the mode that suppresses approval prompts for commands the framework classifies as dangerous. The logs then captured the agent carrying out the assigned work.
Staged payloads do not prove deployment
Some activity had stronger supporting evidence. Hunt.io found a PHP web shell at a path on a ministry web server. Scripts and configuration files named internal ministry hosts, Hadoop services, mail systems and administrative applications.
Other findings remain qualified. Cookie jars contained session and CSRF values for an administrative panel, but those values alone do not establish authenticated access. GlassFish automation was built to authenticate through a local SOCKS5 proxy and deploy a WAR file; the researchers could not confirm that the tunnel was active or that the deployment succeeded.
The server also held exploit code for CVE-2021-3156, CVE-2021-4034 and CVE-2017-7269. The files show preparation, not successful exploitation.
Hunt.io analyzed Windows and Linux samples of a Go implant the operator called Hades. The samples supported an interactive shell, persistence, file transfer and a SOCKS proxy, among other functions. Their command-and-control addresses helped link related infrastructure. The report does not establish that every Hades build in the directory reached a ministry system.
VShell payloads appeared on shared infrastructure as well. Hunt.io said it could not confirm whether VShell was used against the ministry or any other target in the activity.
Unattended mode needs an enforceable scope
An enterprise agent with shell access can act only within the identity, tools, secrets, files and network paths available to its runtime. Disabling command approval removes a checkpoint inside that existing reach. It does not create new privileges, but it allows an assigned task to continue without a person reviewing each proposed command.
Teams that permit unattended execution should define the authorization in terms the runtime can enforce: the responsible owner, permitted tools, execution identity, target hosts or directories, and an expiration event. The agent should not be able to widen those limits, attach another tool, replace its credentials or extend the session.
The audit record should show who enabled unattended mode, which task and scope it covered, every command or tool call made under that authorization, and what ended it. Alert on changes to the approval policy, tool inventory, credential scope and startup flags, as well as sessions that outlive their declared window.
Test the boundary with a harmless request outside an approved test directory or host. The expected result is a denied call and a policy event that identifies the rule. A system that permits the action and records it afterward has logging, not enforcement.
Detect the host behavior
Hunt.io identified two Hermes-specific pivots on exposed operator infrastructure: the HermesWebUI server header and output written beneath /hermes-results/. Those strings can locate public panels and working directories, but defenders inside a target network should follow the resulting host behavior.
The report offers several concrete checks. Configure HiveServer2 to reject unauthenticated SASL PLAIN sessions and enforce its UDF blocklist. Audit web roots recursively for hidden PHP files that resemble service caches. Investigate web-server processes connecting to internal Hadoop ports such as 10000 and 50070. Restrict GlassFish administration to trusted networks, remove default credentials and reconcile deployment history with approved changes.
Privilege-escalation code for older flaws also appeared in the staging set. Patch sudo for CVE-2021-3156, check polkit exposure to CVE-2021-4034, and retire IIS 6.0 systems or disable WebDAV where CVE-2017-7269 remains relevant.
None of those controls depends on identifying a command as AI-generated. They constrain the access paths and system actions recorded in the incident, regardless of whether an operator, script or agent issued the command.
Verify the response by replaying a harmless out-of-scope request. The expected result is a denied action, a policy event tied to the agent run and no new shell, persistence or credential-access activity on the host.