Case bugster-deepseek-v4-india-universitiesAI-assisted malwareIndia
BUGSTER uses DeepSeek V4 as AI cybercrime assistant against Indian universities
Unit 42 reports that an actor using the handle BUGSTER ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine, plus Cursor, with safety controls disabled. The actor ran an AI-generated brute-force campaign against one Indian university's website and achieved a confirmed intrusion at a second university, exfiltrating a database of more than 5,200 records with personal data on students. Unit 42 also found AI-assisted planning for VoIP fraud, Wi-Fi password cracking and cryptocurrency-holder reconnaissance, but no evidence of active call routing.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 21, 2026
- Location
- India
- Target
- Indian organizations, including universities
- Severity
- Medium
- Verification
- Reported by credible press or researchers
- Triggered by
- BUGSTER
- Actor type
- cybercriminal
- Sector
- Education & research
- Reported loss
- None reported
- CVE
- None
What happened
Unit 42 reports that an actor using the handle BUGSTER ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine, plus Cursor, with safety controls disabled. The actor ran an AI-generated brute-force campaign against one Indian university's website and achieved a confirmed intrusion at a second university, exfiltrating a database of more than 5,200 records with personal data on students. Unit 42 also found AI-assisted planning for VoIP fraud, Wi-Fi password cracking and cryptocurrency-holder reconnaissance, but no evidence of active call routing.
Impact: Database of 5,200+ records with student and faculty personal data stolen from an Indian university; attack surfaces of other Indian organizations mapped.
Who triggered it
Actor: BUGSTER
Attribution: Unit 42 (Palo Alto Networks) tracks the actor under the handle BUGSTER; no further attribution is given in the summary.
Motive: Data theft
How it happened
Attack vector: AI-generated reconnaissance and scripts driven by DeepSeek V4 configured as the reasoning engine of the operation.
Root cause: Unknown
Timeline
- Reported by GBHackers
Response
Unit 42 published its findings; no other response is stated.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- GBHackers gbhackers.com
- Unit 42 (Palo Alto Networks) unit42.paloaltonetworks.com
- Cybersecurity News cybersecuritynews.com
Cite this case
BUGSTER uses DeepSeek V4 as AI cybercrime assistant against Indian universities. AI Threat Watch, case bugster-deepseek-v4-india-universities, Oct 21, 2026. https://aithreat.io/cases/bugster-deepseek-v4-india-universities/
Permanent link: https://aithreat.io/cases/bugster-deepseek-v4-india-universities/
Related cases
The same type of incident, most recent first.