Ledger / Oct 2026
BUGSTER uses AI-generated tooling against an Indian university
Confirmed
Unit 42 inspected the actor's environment, AI configuration and attack artifacts.
- Model
- DeepSeekDeepSeek · openness unknown
- Agent harness
- Hermes Agent, Cursoropen-source harness
- Attributed country
- Not attributedthe source names no country
- Sectors hit
- educationAn Indian university's online education platform
AI-generated reconnaissance and scripts supported a real university attack. October is the disclosure month; the attack date was unspecified.
Sources
- “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesUnit 42, Palo Alto Networks · 21 Oct 2026
- Date
- Oct 2026
- Disclosed
- 21 Oct 2026
- Actor
- BUGSTER (criminal), as attributed by Unit 42, Palo Alto Networks
- Targets
- An Indian university's online education platform
- What the AI did
- Recon, Ops automation
- Model as named
- DeepSeek V4
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Enumerated user identities and ran credential brute force; tooling flagged a candidate valid login.