A threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during an alleged breach of Thailand’s Ministry of Finance.

The activity was uncovered by threat intelligence company Hunt.io and security researcher Bob Diachenko after they discovered several exposed web directories containing hundreds of files associated with the operation.

Hunt.io says session files, deployed web shells, and evidence of access to internal systems indicate that the attackers compromised multiple systems within the ministry’s network.

However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised.

BleepingComputer contacted Thailand’s Ministry of Finance and ThaiCERT to confirm the reported attack and will update this story if we receive a response.

Attack infrastructure exposed online

Between July 9 and July 13, Hunt.io discovered three simultaneously exposed directories on a server hosted in Hong Kong.

The directories contained 585 files totaling approximately 470 MB, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent.

The recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address, and included scripts targeting internal services.

Some scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords.

Hunt.io also found a PHP web shell that it says had been deployed on a Ministry of Finance web server.

The researchers linked the initial server to additional attacker-controlled infrastructure by shared TLS certificates used during the same time period.

“In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents,” explained Hunt’s report.

“Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong).”

One of those servers was later linked to the operation through a command-and-control address embedded in a recovered implant.

The directories also contained Windows and Linux builds of a previously undocumented Go-based implant that the operator called Hades.

However, the more interesting discovery was a collection of logs showing that the attackers used an AI agent, Hermes, to automate parts of the cyberattack against the ministry.

Hermes operating in YOLO mode

Hermes is an open-source AI agent released in February 2026 that runs as a persistent service and can remember information between different task sessions.

The AI agent can interact with tools and execute commands while working on tasks provided by the operator.

The software includes a setting known as YOLO mode, which removes prompts that would require a person to approve dangerous commands.

The researchers were able to recover environment information and Hermes output logs from the exposed directories that showed the operator had enabled this unattended mode. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step.

Five recovered Hermes call logs show the agent was used to find a way to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems.

Hermes was also told to use a customized version of the LinPEAS privilege-escalation enumeration script to collect information from a Ministry of Finance host.

In another task, the operator instructed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance.

The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. However, Hunt says it found no evidence that these files were exfiltrated.

The findings do not indicate that Hermes independently decided to target the ministry.

Instead, the exposed logs show an operator supplying the agent with objectives and tooling while YOLO mode allowed it to carry out routine post-exploitation commands without constant supervision.

Hunt.io says the recovered artifacts depict an active intrusion in which tools had been staged and access to internal systems was expanding. However, the researchers could not determine how the attackers initially gained access.

The company and Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15. According to the report, both organizations acknowledged receiving the notification that day.

This Hermes activity is the latest example of autonomous AI agents being used to conduct cyberattacks.

Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption.

Autonomous agents can also cause real-world breaches, even if unintentional.

OpenAI recently disclosed that its models autonomously hacked Hugging Face while undergoing cybersecurity benchmark testing, exploiting zero-day vulnerabilities to escape a sandboxed testing environment and access the internet.

It then used stolen credentials and additional vulnerabilities to breach Hugging Face’s production systems.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers.

The incident was detected on March 23, and an internal investigation revealed that the attacker accessed certain files between March 20 and 22.

Apart from names, it is unclear what type of information was exposed, as the company redacted the data elements in the notification sample shared with authorities.

OnTrac is a private American parcel-delivery company specializing in “last-mile” e-commerce deliveries, formed in 2021 from the merger of OnTrac Logistics and LaserShip.

The firm operates at 102 locations across 35 states, covering roughly 70% of the U.S. population, and working with more than 7,000 independent delivery contractors.

In response to the security incident, OnTrac contracted a third-party specialist to help determine the scope of the breach and took steps to “ensure the data described above was re-secured and not distributed.”

This statement suggests a possible agreement between the firm and the attackers, typically a ransom payment, to make sure that the customer information is not leaked.

“We are not aware of any fraud or publication of stolen information resulting from this incident, nor do we have any reason to believe any such misuse of information will occur,” OnTrac says in the notification.

To help exposed customers mitigate the risks that may arise from the exposure of their sensitive data, OnTrac is offering free-of-charge access to a 12-month credit monitoring and identity protection service via CyberScout, with a 90-day enrollment deadline.

Recipients of the letter are also recommended to review their credit reports and account statements, and consider placing a free fraud alert or credit freeze if the risk is deemed significant.

BleepingComputer has contacted OnTrac to learn more about the attack, the number of impacted clients, and whether a ransom was paid, but we have not heard back by publication time.

At the time of writing, no ransomware or data extortion threat groups have taken responsibility for the attack.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

• Jetkiller reaches 370 km/h to chase faster Russian Shahed attack drones
• The original P1-SUN reportedly destroyed more than 5,500 Russian drones already
• SkyFall plans serial production of the upgraded interceptor beginning in August 2026

Ukrainian drone manufacturer SkyFall has unveiled the P1-SUN Jetkiller, an upgraded interceptor built to counter Russia’s jet-powered Shahed attack drones.

The new model made its public debut at the recent Farnborough International Airshow in the United Kingdom.

Home cinema projectors are all over the map in terms of price and performance. It’s often the case that you get what you pay for. High-end projectors that mimic what you see at the local cineplex can cost upwards of $6,000. On the lower end, you could easily pay less than $1,000 for a home projector, but you may sacrifice brightness, contrast, and color quality. Many of our favorite projectors sit somewhere in the middle in terms of price and quality. That is certainly true of the BenQ TK705STi short-throw projector.

The main cost-justifying reason to consider buying this 4K projector appeals to gamers, who will appreciate its low-latency performance and larger screen size. Once you see James Bond on a 12.5-foot screen while playing 007 First Light on Xbox, you’ll wonder why you didn’t make the upgrade sooner. Being a short-throw projector, it’s also nice to be able to operate the TK705STi in just about any room in your home. You can position it a few feet from a wall or across the room, allowing for great flexibility.

That said, the TK705STi is not for everyone. Movies and TV shows didn’t look that impressive using this projector—certainly not in comparison to the top-rated Leica Cine Play 1, which costs about twice the price. I also dealt with a few glitches with auto-keystoning; once I figured out how to manually adjust the screen, this was fine but still a pain.

Mainly, though, I recommend the TK705STi for gamers who don’t need high-end home-cinema picture quality, since the overall performance of this projector is just average.

Living the Short-Throw Dream

The BenQ TK705STi is a short-throw projector that’s designed to sit close to the wall. The TK705STi has a throw ratio of .8:1, which means you divide the wall size by the short-throw percentage. To get a 10-foot-wide image, for example, you’d place the projector about 8 feet away, which is exactly what I did in my windowless test area. (Later, in a brightly lit family room with big windows, I increased the screen size to 12 feet wide by placing the projector 10 feet from a wall.)

After I put the projector in its spot, I noticed its legs were just a bit shaky. Not wobbly, but lacking the stability I would prefer for a midrange projector like this one. If I bumped the table, the projector would jostle around quite easily and even start auto-keystoning again—a feature I found to be finicky at best, often mapping incorrectly to the wall or screen. (For what it’s worth, BenQ reps said this is not normal and could have been related to my projector screen.)

There is a moment early in Halo: Campaign Evolved where I stopped thinking about the remake as a game for a second. I was watching one of its newly rebuilt cutscenes. Master Chief, Captain Keyes, Cortana, the Pillar of Autumn, and the enormous scale of everything around them suddenly appeared a lot more cinematic than ever before.

I played the original Halo: Combat Evolved in the early 2000s, and in my head, this was exactly how it looked and felt. The first Halo title introduced intergalactic war to me long before Star Wars, and the cinematic tastefully adds enough minor touches that enhance Bungie’s original work from decades ago.

The wider framing, lighting, and character models in the pre-rendered presentation were great, till one irritating thought entered my head. Why have we still never received a proper Halo show that looks like this?

Halo turns 25 this year. The franchise has decades of games, novels, comics, animation, short stories, and characters to draw from. Campaign Evolved has somehow made the absence of a great screen adaptation even more frustrating.

Halo has always had cinematic DNA

Bungie’s Halo games traditionally handled their storytelling through in-engine cinematics. This gave games a consistent visual identity because the characters you watched during a story sequence were the same ones you controlled seconds later. It also allowed for some hilarious interactions and experimentation, but that’s besides the point here.

The series has occasionally taken a more movie-like route since then. Halo 2 Anniversary famously replaced its original cinematics with gorgeous pre-rendered sequences, and Campaign Evolved now gives the original adventure a similar treatment with completely rebuilt scenes. Seeing that approach applied to Combat Evolved was a surprise to me.

The opening aboard the Pillar of Autumn already contains everything a sci-fi series needs. Humanity is losing a war against an overwhelming alien force. A mysterious ringworld appears in space. You feel the desperation from UNSC personnel. Amidst the chaos, Master Chief rises as this enormous, almost mythical figure. Campaign Evolved presents those moments with enough visual detail that I could easily imagine watching them as part of a big-budget series.

Halo tried to reinvent itself too soon

We already had the expensive live-action attempt, of course. Paramount+ launched Halo in 2022 after years of development. I desperately wanted to like it. There were pieces I appreciated, especially some of the production design, Covenant battles, and the occasional glimpse of the military sci-fi spectacle I had imagined. But the larger creative direction lost me.

The series created its own Silver Timeline, separate from the established continuity of the games, novels, and comics. This gave the writers freedom to reshape characters and events, which isn’t inherently wrong. But when the show started deviating heavily from the core identity of integral characters like Master Chief, it brought the whole thing down to a screeching halt for me.

I won’t go into all the details of my experience with the show, but I will admit that Season 2 tried to build on some of the strengths of the first. The action scenes improved, and we finally reached the Fall of Reach. Yet the show continued moving through its own version of Halo before Paramount eventually cancelled it after two seasons.

Getting creative with a very established property can be done exceptionally well. The first episode of Star Wars: Visions is a great example. It reimagined the whole concept in a completely different setting and style, and did it supremely well.

The difference between Halo and Star Wars is that the former never really got to spread its wings in this form of media. Halo was already a massive name in gaming, but outside of that, it had mostly experimented with animation, live-action miniseries, and other smaller projects. So when its highly anticipated first major TV adaptation finally arrived, taking the story in such a dramatically different direction killed its screen art moment.

We already know Halo works outside games

Some of my favorite Halo stories have nothing to do with holding a controller. Halo Legends explored the universe through animation, jumping between different characters, periods, and artistic styles. Forward Unto Dawn took a much smaller live-action approach, following UNSC cadets during the early Human-Covenant War before bringing Master Chief into the story.

Neither project required rewriting the foundation of Halo. Forward Unto Dawn especially showed how effective Chief can be when he enters someone else’s story. The character carries enormous presence precisely because we spend time watching ordinary people respond to him.

Then there are the novels. The Fall of Reach alone contains the Spartan-II program, Chief’s childhood, Dr Halsey, the Covenant war, Blue Team, and the destruction of one of humanity’s most important colonies, while Ghosts of Onyx could open an entirely different corner of the Spartan program. There are decades of established stories waiting to be adapted.

The universe has never lacked material.

A television series could even follow characters around Master Chief rather than keeping him at the center of every episode. Halo’s universe is large enough to support military drama, horror, political intrigue, espionage, and enormous space battles without leaving its established history behind.

Campaign Evolved reopened the wound

Playing the first level of Campaign Evolved brought all of this back. Watching those widescreen cinematics, I kept taking screenshots because individual frames already resembled shots from the Halo production I have wanted for years. The Covenant designs are there, and Chief still carries that imposing silhouette.

Halo Studios describes Campaign Evolved as a celebration of the story that started everything 25 years ago. For me, it also demonstrates how little the original premise needs to change. Give me the Human-Covenant War, Blue Team, or any of the terrifying encounters with the Flood. Let Master Chief remain as a soldier whose humanity appears through smaller moments instead of rewriting him into a conventional television protagonist.

• US factories prepare to manufacture Ukraine’s battle-tested MAGURA naval drones domestically
• MAGURA V7 reportedly destroyed an aerial target using Sidewinder missile technology
• Oregon and South Carolina will host future MAGURA drone production facilities

Ukrainian defense company UFORCE has signed an agreement with US boatbuilder RECONCRAFT to manufacture the combat-proven MAGURA naval drones domestically.

Reports from The Wall Street Journal has claimed the memorandum of understanding was recently signed at the Embassy of Ukraine in Washington, with production planned at facilities in Oregon and South Carolina.

The Smart LED Monitor Stand is currently available for $169.99.

The lease programme, known as Apple Upgrade, will reportedly support most iPhone, Mac, iPad and Apple Watch models.

Apple is set to debut a new leasing programme for its devices next week, according to Bloomberg.

The programme, known as Apple Upgrade, will support most iPhone, Mac, iPad and Apple Watch models, according to the publication, which cited anonymous sources close to the matter.

Apple Upgrade will reportedly work like a subscription and users can pay off the device early during their leasing term, upgrade early to a new model or keep it at the end of the leasing period. These transactions may incur an additional fee in “certain cases”, said Bloomberg.

The leased device can also be returned at the end of the term.

Sources told Bloomberg that Apple plans to advertise Apple Upgrade as “as a way to have lower payments versus current financing programmes”, and that the tech giant is planning to halt new enrolments to its existing iPhone payment programmes.

The lease terms for iPhones and Apple Watches will last for 24 months, according to the report, while Mac and iPad leases will run for 36 months.

The tech giant – which previously considered a subscription service for iPhones a few years ago – is also partnering with Klarna for the service, with the payment provider acting as financial backer for the programme.

Apple Upgrade is set to initially launch in the US on 28 July and will be available in Apple’s physical retail stores and online.

Apple price hikes

The news of the upcoming leasing programme comes after Apple raised prices for several of its product ranges last month, citing the ongoing chip shortage and rising component costs.

“The rapid expansion of AI data centres has created an extraordinary surge in demand for memory and storage”, a company spokesperson told news publications at the time, adding that Apple has “never seen a component price increase this much, this quickly”.

Apple said that the worsening situation meant that it couldn’t shield customers from the rising component costs any longer.

While last month’s announcement did not include a price hike for iPhones, recent reports indicate that may be about to change.

Yesterday (21 July), publication Nikkei Asia reported that the world’s largest chipmaker TSMC, which makes processors for a number of tech giants including Apple, plans to raise prices for both its advanced and mature chip production services by up to 10pc in 2027.

The price hike for Apple’s smartphones appears to be already happening, at least in one country so far.

This week it was confirmed that iPhone 17 prices had risen on Apple’s official Japan store, jumping by roughly 10pc from $797 to $877. The iPhone 17 Pro also rose in price, jumping by more than 8pc, while Apple Watch and AirPods models also rose by up to 10pc.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Motorola Edge 2026 for $600: I surprisingly enjoyed my month with the new Motorola Edge. It’s amazingly lightweight at just 160 grams, and the 6.3-inch screen size feels fairly compact. If you hate big, heavy phones and have longed for the days of smaller handsets, the Edge is worth a look; it’s not as small, but it feels great to use one-handed. Performance is more than capable, though you will feel some sluggishness here and there. The cameras are reliable—there’s even a 3X optical zoom telephoto alongside the 50-MP ultrawide and 50-MP primary—but it’s not going to knock your socks off. It will only get two Android OS upgrades and three years of security updates, which is not really acceptable for a $600 phone. Get it on sale!

Motorola Razr+ 2026 for $1,100: The Razr+ is the awkward middle child of the Razr lineup. I’ve never liked it. It doesn’t have all the bells and whistles or top-notch specs of the Ultra, but still costs more than $1,000. You can get very nearly the same experience with the cheaper Razr and save hundreds. Even battery life is the least impressive of the lot, because it has the smallest capacity. The cover glass isn’t the ceramic glass mixture as on the Razr Ultra, and I found out the hard way. I dropped the phone once, roughly a four-foot drop onto asphalt, and the front screen shattered. Get a screen protector!

Moto G 5G

Photograph: Julian Chokkattu

Moto G 5G 2026 for $299: The Moto G 2026 is nearly identical to the Moto G Play 2026 below, except it has double the storage (expandable via microSD), supports slightly faster wired charging, and the front and rear cameras pack more megapixels. It’s a $50 difference, so if you’re eyeing either one, you really should go for the Moto G 5G 2026. Performance is similarly sluggish, though perfectly usable day to day (if you’re patient). Even with more megapixels, don’t expect much from the cameras; they can take passable photos in good lighting, but struggle to do so in low light. I was able to hit nearly two days of battery life with average use, and I like that this phone still has the headphone jack. However, keep in mind that it will receive only two Android OS updates and three years of security updates. I think you’re better off buying the Moto G Power 2026 on sale. It’s worth noting that Motorola suddenly jacked up the prices of this device and the Moto G Play.

Moto G Play 2026

Photograph: Julian Chokkattu

Moto G Play 5G 2026 for $250: Motorola’s cheapest phone always sits in an awkward spot. It was originally under $200, but Motorola increased the price to $250. I don’t think it’s worth it at that price, but for under $200, it’s a serviceable handset that now features 5G connectivity. You get two-day battery life, a headphone jack, expandable storage, and a pretty nice design. But the MediaTek Dimensity 6300 chip with 4 GB of RAM is very sluggish—get ready to wait a second or two, sometimes more, for an app to launch or a webpage to load. Photo quality is passable; most of my images have lackluster colors. I took several calls, and the people on the other end generally complained about my audio quality, which isn’t great. It’s nice that this ultra-budget phone will get two Android OS updates, but I’d wait for the Moto G Power 2026 to eventually dip to $250 during major sale events.

What Motorola Phones to Avoid

Motorola Moto G 2025

Advertisement

Photograph: Julian Chokkattu

Motorola phones diminish in value fairly quickly. You should avoid buying Moto G phones from 2025 or earlier. They likely won’t get any more Android version updates, and the prices aren’t drastically different from the latest models. Last year’s Motorola Edge 2025 or the Razr (2025) series are the oldest I’d go, assuming prices are a good deal lower than the latest models, so don’t consider anything else.

Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin.

The emails claim to come from ShinyHunters and tell recipients that hackers compromised their devices after obtaining their email addresses from breached company databases.

However, the messages appear to be sent by someone who downloaded data previously leaked by ShinyHunters rather than by the extortion group itself, using the exposed email addresses to make the threats appear more legitimate.

BleepingComputer has seen leaked data from the Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill breaches used in this sextortion email campaign.

For some recipients, BleepingComputer confirmed that the email addresses targeted by the sextortion emails were actually included in the associated data previously leaked by ShinyHunters.

Extortion gangs often warn victims that refusing to pay will expose their customers and employees to additional abuse once stolen data is published. While those claims are intended to pressure organizations into paying, this campaign illustrates how leaked data can later be repurposed by unrelated threat actors for malicious purposes.

While the use of a recipient’s leaked email address may make these emails appear more convincing, there is no indication that the sender compromised recipients’ devices, installed malware, accessed their cameras, or monitored their activity on adult websites.

BleepingComputer contacted the ShinyHunters extortion group, which denied any involvement in the sextortion email campaign.

Fake ShinyHunters sextortion emails

In the emails seen by BleepingComputer, they are sent from random email addresses using the names “ShinyHunters” or “You’ve Been HACKED” and have the subject “Information about your online security.”

The messages claim to be from the ShinyHunters hacking group and state that the attackers gained access to the recipient’s devices several months earlier.

The sender then names a company whose data was previously published by ShinyHunters, claiming that the breach allowed them to access the recipient’s email account.

The email falsely claims that the attackers later “installed an exploit” on the victim’s computers and phones, allowing them to access the microphone, camera, keyboard, photos, browsing history, conversations, and contact list.

The sender then claims to have recorded the recipient visiting adult websites and threatens to share intimate videos with their friends, colleagues, and family.

To prevent the alleged release of these compromising videos, the victim is told to send $2,000 in Bitcoin within 48 hours.

The email also warns recipients not to contact police, reply to the message, or reset their devices, claiming that the stolen information is stored on remote servers.

These types of emails are known as “sextortion” emails and are designed to frighten recipients into paying a demand out of worry that they will have their reputation hurt with friends, family, and work colleagues.

However, there is nothing to indicate that the sender ever had access to the recipients’ devices or personal activity.

Instead, the attackers use details from published leaked data breaches, such as an email address and the name of the breached company, to make a sextortion scam appear targeted.

While you may think that no one would fall for these scams, they were very profitable when they first appeared in 2018, generating over $50,000 in a week.

Since then, scammers have created a wide variety of extortion email scams, including ones that pretend to be hitman contracts, information about cheating spouses, bomb threats, CIA investigations, and threats of installing ransomware.

Campaign started in April

The sextortion campaign appears to have started in April, with numerous people and organizations reporting similar messages or warning recipients to ignore them.

One person who received an email referencing the Betterment breach posted about it on the Betterment Reddit.

Betterment responded that it was aware some clients had received threatening emails claiming to come from a hacking group.

“These messages are part of a common extortion scam designed to intimidate recipients,” Betterment said.

“Please note, knowing an email address does not provide the ability to install malware or access someone’s device.”

The company advised recipients not to reply, send payment, click links, or open attachments and to delete the email. Betterment also asked customers who had interacted with the message to contact its fraud team.

Although their email address may have appeared in one of the published data leaks referenced in the email, this does not mean the sender compromised their devices, recorded videos, or obtained any of the other information described in the message.

Recipients of these messages should not pay the ransom or respond to the sender.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper