BUGSTER: one operator ran cybercrime through a Telegram AI agent

01What happened

Unit 42 published its first report on BUGSTER on October 21, 2026, describing an English-speaking, financially motivated operator it had not tracked before. Unit 42 says the operator drove the Hermes Agent framework from Telegram, with DeepSeek V4 as the reasoning engine and its safety controls removed through a system-prompt override. The report ties the activity to an email address, a display name, a Cursor IDE user ID and a Telegram user ID.

02How it works

Two controls were turned off rather than broken. A system-prompt override disabled the model's safety behaviour inside Hermes, and a proxy script bypassed Cursor's permission and sandbox controls so the IDE produced attack code without the usual approval steps. Unit 42 says the operator tested GLM 5.2 and other models through OpenRouter before settling on DeepSeek V4, and had Cursor configured with Claude Opus 4.8, GPT-5.5 and Composer 2.5. Separate Hermes bot profiles handled different jobs.

03Who is affected

Named victims are two Indian public universities and an e-commerce site. Unit 42 reports that reconnaissance and a brute-force tool against the first university's WordPress platform produced one valid login, and that more than 5,200 student and faculty records with personal data left the second university's MongoDB database. The report also describes Wi-Fi handshake capture, which needs physical proximity to the target, and cryptocurrency reconnaissance it assesses as preparation for later targeting.

04What to do

Block the two IP addresses Unit 42 lists and hunt for the agent artefacts it documents. Because both of this operator's bypasses were configuration changes rather than exploits, audit developer machines for AI IDE settings that disable sandboxing or route traffic through a local proxy, and for agent frameworks whose system prompts have been edited.

Questions people ask

Which AI models did BUGSTER use?

Unit 42 reports that BUGSTER settled on DeepSeek V4 as the reasoning engine inside the Hermes Agent framework, after testing GLM 5.2 and other models reached through OpenRouter. The operator's Cursor installation was separately configured with Claude Opus 4.8, GPT-5.5 and Composer 2.5. Safety behaviour in Hermes was switched off with a system-prompt override rather than a multi-turn jailbreak.

How did BUGSTER get past Cursor's permission controls?

Unit 42 says a proxy script bypassed Cursor's permission and sandbox controls, so the IDE generated attack tooling without the usual approvals. The report presents this as a configuration bypass rather than a flaw in Cursor, and pairs it with the system-prompt override used on the Hermes side. Both leave artefacts on the developer machine that defenders can search for.

Was BUGSTER's VoIP fraud operation actually running?

Unit 42 assesses the VoIP fraud effort as planning or early setup, and reports no call logs and no active routing. A Hermes bot profile named alice served as an advisor on standing up the operation. The cryptocurrency activity is rated similarly: 45 wallets were documented from the top 500 ETH holders, with no follow-on activity observed.

How does BUGSTER compare with the earlier Hermes Agent operator?

Unit 42 reported in July 2026 on a Chinese-speaking actor who ran DeepSeek inside Hermes Agent for autonomous enumeration and exploitation across hundreds of targets. BUGSTER uses the same framework and Telegram control pattern but spreads across credential theft, VoIP fraud planning, Wi-Fi cracking and crypto reconnaissance, with a separate Cursor bypass for building tooling.

Sources 2 links, all fetched

1. 1unit42.paloaltonetworks.comUnit 42 Report
2. 2unit42.paloaltonetworks.comEarlier Hermes Report