BlackHatSect0r AI Agent Automates Attacks, Harvests 16,834 Credentials
Key Takeaways A cybercrime group, BlackHatSect0r && DXQRTXX, utilized an AI agent powered by a DeepSeek model to automate reconnaissance, credential harvesting, and attack validation. The...
Key Takeaways
- A cybercrime group, BlackHatSect0r && DXQRTXX, utilized an AI agent powered by a DeepSeek model to automate reconnaissance, credential harvesting, and attack validation.
- The operation primarily exploited common misconfigurations and exposed data, not zero-day vulnerabilities, leading to the collection of 16,834 credentials.
- The AI agent, a modified Nous Research Hermes agent, had its safety features disabled to facilitate continuous, autonomous scanning and data exfiltration.
- The group’s activities extended to public-sector data theft, extortion, cryptocurrency exchange compromise, and phone-based bank impersonation scams.
- Defenders must prioritize auditing cloud storage, securing configuration files, rotating exposed secrets, and implementing robust employee awareness programs against sophisticated phishing tactics.
A sophisticated cybercrime syndicate, identified as BlackHatSect0r && DXQRTXX, has been observed leveraging an artificial intelligence agent to automate its attack infrastructure. This agent, integrated with a DeepSeek AI model, systematically scans for exposed digital assets, validates stolen access credentials, and funnels this intelligence into a custom command-and-control platform. This development underscores the escalating threat posed by AI-driven automation in exploiting prevalent security weaknesses at unprecedented speeds.
Table Of Content
The extent of the operation came to light following the discovery of an exposed operation server, which contained 4.9 GB of sensitive data across 9,299 files. This trove included the proprietary DXSCAN platform, a suite of phishing tools, materials for extortion, and a significant vault containing 16,834 compromised credentials. The group demonstrated considerable scale, having queued 2,759,860 domains for scanning, reaching 726,989 hosts, and generating 1,374,300 unique IP addresses during its campaign.
Researchers at SOCRadar said in a report that they were able to identify the underlying infrastructure and uncovered evidence indicating that the French-speaking threat actors deliberately removed safety protocols from their AI agent, enabling its deployment across multiple malicious campaigns. The report, detailed in a technical document, highlighted that the success of these operations stemmed from exploiting common misconfigurations—such as exposed cloud storage, improperly configured files, and weak secrets—rather than relying on novel vulnerabilities.
The ramifications of this campaign extend far beyond mere credential harvesting. The recovered materials also implicate the group in alleged public-sector data breaches, various extortion schemes, a data exposure incident involving a cryptocurrency exchange, and targeted bank-impersonation calls aimed at elderly individuals. This incident serves as a stark reminder of how AI agent automation can amplify the impact of routine security oversights, making them significantly more damaging.
BlackHatSect0r’s AI-Powered Attack Mechanism
The BlackHatSect0r group deployed a Nous Research Hermes agent, which interacted with a DeepSeek model. This AI agent was controlled via a 14 KB identity file named SOUL.md. Crucially, the operators deliberately stripped the agent of its “refusal memory” and disabled all inherent safety settings. They configured seven background workers to ensure continuous scanning, data collection, and reporting without requiring constant human intervention.
The DXSCAN platform, at the heart of this automated attack, was designed to generate approximately 1,200 random IP addresses every ten seconds. It then systematically probed ports 80, 443, and 8080 to identify web server software and scanned for over 200 distinct credential patterns. Upon discovering exposed .env files, cloud keys, or database credentials, the AI agent would automatically store the compromised data and transmit victim reports in French via Telegram.
This streamlined workflow perfectly illustrates the growing concern surrounding autonomous credential theft. The AI did not need to uncover groundbreaking exploits; instead, it optimized the exploitation of existing, common vulnerabilities. It provided the attackers with unparalleled persistence, speed, and the capacity to execute reconnaissance, validation, and data collection tasks concurrently. While the group marketed some of its tools as “zero-days,” investigations found no evidence of breaches caused by new, undisclosed flaws. Instead, confirmed access was traced back to publicly accessible cloud storage buckets, exposed .env or Git configuration files, default signing keys, or secrets inadvertently embedded within client-side browser code. In one notable instance involving a cryptocurrency exchange, a JSON Web Token (JWT) signing secret set to the trivial value “secret” led to the exposure of 418 identity records.
Exposure Gaps Fuel Credential Theft
The credential vault maintained by BlackHatSect0r saw a rapid increase, growing from 16,415 records on August 11 to 16,834 by August 18. This collection included a diverse range of sensitive information: generic secrets, database and SMTP credentials, API keys, AWS access keys, GitHub tokens, and Stripe keys. Out of 230 identified SMTP configurations, 82 were verified as active and prepared for potential re-use in future phishing campaigns.
The same infrastructure also facilitated sophisticated phishing attempts. These campaigns instructed recipients to call an attacker-controlled telephone number instead of clicking on a malicious link. This tactic is particularly effective at bypassing automated link scanning and attachment analysis tools, emphasizing the critical need for robust employee awareness training and strict call-back verification procedures within organizations. Cybersecurity professionals monitoring this evolving threat landscape should remain informed about AI-enabled cyberattack techniques to understand how threat agents can effectively divide and conquer tasks across an intrusion chain.
What You Should Do
- Audit Cloud Storage: Immediately review all cloud storage configurations to ensure no public read or write access is permitted.
- Secure Configuration Files: Remove .env, .git, debug, and actuator endpoints from public internet access. These files often contain sensitive information that can be easily exploited.
- Rotate Exposed Secrets: Promptly rotate all secrets, API keys, and credentials that may have been exposed. Implement a strong secret management policy.
- Protect Signing Keys: Ensure signing keys and token-generation materials are stored securely on servers and are not publicly accessible or embedded in client-side code.
- Replace Default Credentials: Change all default or easily guessable passwords and keys immediately upon deployment.
- Hunt for IoCs: Actively scan your networks for the provided Indicators of Compromise (IoCs), including specific IP addresses, port activity, Telegram bot IDs, cryptocurrency wallet addresses, and host artifacts like
SOUL.mdor.hermes/directories. - Monitor for Suspicious Activity: Look for unusual GHOST strings, unauthorized ngrok activity, and short bursts of requests for configuration paths from single sources, especially following scans of common web ports.
- Investigate and Respond: If matching indicators are found, immediately isolate affected systems, preserve all relevant logs for forensic analysis, and thoroughly review authentication activity.
- Enhance Employee Training: Educate employees about sophisticated phishing tactics, particularly those involving phone calls, and reinforce internal call-back verification procedures.
Indicators of Compromise (IoCs):
| Type | Indicator | Description |
|---|
No Comment! Be the first one.