AI-Assisted Attacker “BUGSTER” Targets Indian Organizations, Steals University Data

A cybercriminal using the handle “BUGSTER” used artificial intelligence tools to support intrusions against Indian organizations, including two universities, according to researchers at Palo Alto Networks’ Unit 42.

In one confirmed breach the actor exfiltrated a MongoDB database containing more than 5,200 records with personal information about students and staff. Unit 42 did not identify the affected universities.

Unit 42’s investigation found the attacker combined the Hermes Agent AI assistant framework with DeepSeek V4 as a reasoning model, and used Cursor as a coding aid. The operator disabled safety controls and relied on AI-written scripts and reports to carry out much of the work. The report notes this demonstrates how AI can enable a less-skilled individual to perform tasks that previously required greater expertise, but emphasizes that the model itself did not act independently.

How the intrusions were carried out

In one incident the attacker used AI-assisted reconnaissance to map an online education platform, identifying a WordPress site, a learning-management system, a student portal and an administration dashboard. Using that information, the actor attempted common passwords and discovered at least one working account. Unit 42 said this activity was separate from the MongoDB theft; the stolen database came from a different university intrusion.

In the second confirmed case the actor accessed a public university’s administrator account protected by a weak password and copied the MongoDB database. The data included records for diploma, undergraduate and postgraduate students, as well as faculty details. Unit 42 also found records describing portions of the university’s cloud and database configuration. These incidents illustrate how exposed services or weak credentials can lead to major data loss even without a newly discovered software vulnerability.

AI-supported activity across multiple schemes

Beyond the university intrusions, Unit 42 found evidence the actor used AI-generated reports to organize research and to produce scripts, alongside a credential-scanning toolkit intended to find exposed secrets such as cloud keys or private keys in files and logs. Such discoveries can give attackers access to otherwise protected services.

The actor created separate AI profiles for different tasks: one was used to research VoIP fraud techniques, another to investigate phone carriers. Unit 42 located planning materials but did not find call records or other evidence that phone-fraud operations had been executed—meaning the report documents preparation rather than confirmed, completed fraud.

Other activity included an automated process to attempt Wi‑Fi password cracking; Unit 42 noted this required a device close to the target networks, indicating the attacker likely had local access to those locations. The actor also collected information about large cryptocurrency holders, but researchers saw no follow-up attacks against those wallets.

Unit 42’s findings build on broader concerns about AI models producing harmful guidance. The key lesson here is that attackers can combine an AI model with commonplace tooling and weak account security to pursue multiple types of crime.

Recommended defensive measures

Unit 42 recommends organizations—especially universities—take the following steps to reduce similar risks:

• Review administrator and privileged accounts; remove weak or reused passwords and enforce multi-factor authentication where possible.
• Limit database access to approved systems and users and restrict internet-facing services to what is required.
• Monitor account activity for unusual logins or bulk access to records.
• Protect secrets such as API keys and cloud credentials by keeping them out of public files and logs; if a credential may have been exposed, revoke or rotate it and review access logs for misuse.
• If AI tools are used legitimately, restrict their permissions, keep safety and approval controls enabled, and review their outputs and actions.

These controls address the vulnerabilities highlighted in the report and do not depend on identifying a particular AI model. The case also underscores the importance of monitoring what AI agents can access and limiting their capabilities where appropriate.

Indicators of Compromise (IoCs)

Note: IP addresses are intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Source: Unit 42, Palo Alto Networks.