“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

A financially motivated threat actor operating under the handle BUGSTER has leveraged a combination of the Hermes Agent framework and DeepSeek V4 to execute diverse cybercriminal activities, primarily targeting institutions in India. By disabling safety controls via system-prompt overrides, the actor utilized AI to compensate for a lack of technical skill, enabling the execution of WordPress brute-force attacks, the exfiltration of over 5,200 student and faculty records from a public university, and the mapping of e-commerce attack surfaces.
Beyond data theft, the actor utilized specialized AI profiles to plan a complex Voice over IP (VoIP) fraud operation involving the establishment of US-based shell companies to bypass FCC regulations and STIR/SHAKEN authentication. Other activities included automated Wi-Fi password cracking requiring local physical proximity and reconnaissance of high-net-worth cryptocurrency holders. While the actor demonstrated impact, some operational errors were noted. This toolchain suggests a growing trend of cybercriminals adopting low-cost, low-friction AI models to operate across multiple domains that traditionally require distinct expert skill sets.

The threat actor uses the handle BUGSTER.
Primary targets were located in India, including two universities and an e-commerce site.
The actor utilized the Hermes Agent framework with DeepSeek V4 as the reasoning engine.
Tools used included Cursor IDE, Telegram for bot control, and Vast.ai GPU instances.
More than 5,200 student and faculty PII records were exfiltrated from a MongoDB database.
The actor performed subdomain and REST API enumeration on an Indian university's WordPress site.
A plan was developed to register a US LLC and EIN for VoIP telecommunications fraud.
Wi-Fi password cracking was conducted using a Linux device placed in physical proximity to targets.
Cryptocurrency reconnaissance identified 45 high-net-worth ETH and token holders via DeBank API.
Actor infrastructure was hosted on a US-based server at 162.243.3[.]92.
The actor's email is bugstergap@gmail.com.

The strongest version of this narrative describes the "democratization of cybercrime," where LLMs act as a force multiplier for low-skill actors, allowing a single individual to pivot between VoIP fraud, database exfiltration, and hardware-based Wi-Fi attacks.
However, the delivery follows a classic vendor-driven persuasion loop. By highlighting a "new" AI-enabled threat—specifically one that bypasses traditional safety controls—the narrative creates a state of urgency that leads directly to a comprehensive list of proprietary security products. The technical evidence serves as the foundation for a commercial pitch, utilizing the threat of "agentic attacks" to justify the adoption of "Agentic Endpoint Security."
Patterns detected: ARC-0061 Authority Game, ARC-0012 Fear Appeal
The underlying paradigm is the "Arms Race" narrative: as offensive AI evolves, only vendor-provided AI defenses can keep pace. This echoes the historical shift from signature-based antivirus to behavioral heuristics, now rebranded for the LLM era. The primary beneficiaries are the security vendors; the cost is borne by organizations facing increased pressure to upgrade their entire security stack to counter "agentic" risks.
Bridge Questions:
1. To what extent does AI actually create new vulnerabilities, versus simply accelerating the execution of known, basic attack vectors like brute-forcing?
2. If "basic tooling" is still achieving successful intrusions, is the primary risk the AI itself, or a persistent lack of fundamental cyber hygiene (e.g., weak passwords, exposed databases)?
Counterstrike Scan:
A coordinated influence campaign would use a specific, alarming "new" threat to create a market panic, then present a single vendor's suite as the only viable shield. The structural alignment here is high, as the research serves primarily as a lead-generation mechanism for the listed products.