Unit 42 reports a hacker who used AI to breach Indian universities

Unit 42, the research team of Palo Alto Networks, studied a hacker with the name BUGSTER. The hacker used the Hermes Agent framework with DeepSeek V4 as the model for logic, with the safety controls off. Unit 42 says the hacker used basic tools and scripts that AI wrote. Before AI tools were easy to get, the hacker did not have the skills for this work.

What the hacker did

The hacker attacked the online education site of an Indian university in four steps. The hacker found 12 subdomains, which are site addresses below the primary one. The hacker then made a brute-force tool with 117 usernames and 28 usual passwords. It found one correct login.

The result

At a second university, the hacker got a database with more than 5,200 records, which included data on students. The access came from an admin account with a weak password. The hacker also did Wi-Fi password attacks and cryptocurrency research.

What is not known

The source does not tell who BUGSTER is. Unit 42 says some unrelated actors use the same Hermes and DeepSeek set. It says this can be a usual selection, but it gives no count.

Insight: Cheap models with weak safety attract criminals

Unit 42 says DeepSeek models are cheap and easy to jailbreak with one change of the system prompt. In the Korean bank attack, a hacker used Claude agents. Attackers select models by price and by the small effect of the safety rules. This reads as pressure on model makers to make safety hard to remove. A weak admin password is the door.