Observed incident

BUGSTER used AI assistants in university credential theft and exfiltration

Reported

Published here

What happened

Unit 42 traced BUGSTER’s use of Hermes Agent, DeepSeek V4 and Cursor to university attacks in India, including a reported database theft exceeding 5,200 personal records.

Parties and reporting

AI tools and systems: Hermes Agent, DeepSeek V4, Cursor IDE

Outcome

Unit 42 reported confirmed exfiltration from one university and a candidate login from another. VoIP fraud remained planning or early setup; containment and victim recovery were not disclosed.

Operating lesson

Require strong administrator authentication, detect password guessing, restrict database access and monitor bulk data exports.

Evidence and limits

Findings derive from the actor’s operational environment. This is distinct from Unit 42’s earlier Chinese-speaking actor. Model configuration alone does not prove every configured model participated; cryptocurrency follow-on attacks were not observed.

Sources