AI Risk Wire

Cases › security breach › LR-2026-0728

BlackHatSect0r DeepSeek-powered agent harvests 16,834 credentials

Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major
Loss or records 16,834 records
Reported 17 Sep 2026

No source states: developer and model, agent tool, could do, deployer, industry.

Severity major: tier: many third parties, with a stated count of 726,989 hosts reached

A criminal group linked to the handles BlackHatSect0r and DXQRTXX ran an AI agent built on a Nous Research Hermes harness and a DeepSeek model to scan for exposed secrets, test stolen access and feed results into a custom control platform. The operator removed the agent's refusal memory and disabled its safety settings, then ran seven background workers that kept scanning, collecting and reporting without constant human input. The agent generated random addresses, checked common web ports and searched for credential patterns, storing what it found and sending victim reports through Telegram. Researchers at SOCRadar identified the infrastructure and found that safeguards had been removed before the campaigns. An exposed server held a vault with 16,834 credentials. The reported access came from exposed cloud storage, readable configuration files and weak secrets rather than new vulnerabilities. The material also links the group to alleged public-sector data theft and extortion claims.

What happened

1 · What it was doingAn AI agent on a DeepSeek model scanned for exposed secrets and tested stolen access.
2 · What went wrongThe operator removed the agent's refusal memory and safety settings and ran seven workers without constant human input.
3 · What it reached or didThe crew queued 2,759,860 domains and reached 726,989 hosts.
4 · How it was caughtSOCRadar researchers identified the infrastructure and the safeguard removal.

What was done

The credential vault grew from 16,415 records to 16,834 records between August 11 and August 18.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
Credential and privilege abuse
Also37 incidents
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Similar incidents

BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records2026-10-23

All cases of this kind ›

Evidence

No source states: when it happened, when it was found, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

  1. August 11 Credential vault held 16,415 records.
  2. August 18 Credential vault reached 16,834 records.

Not dated in the sources:

  • SOCRadar identified the infrastructure and found the safeguards had been removed before multiple campaigns.
Show every field, with its source and grade

The AI system

What it was for
scan for exposed secrets, test stolen access, and feed results into a custom control platform
C one secondary source states it
State of its safeguards
refusal memory removed and safety settings disabled
C one secondary source states it

What happened

Earliest source we hold
2026-09-17
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Cause in detail
agent safeguards (refusal memory and safety settings) removed by the operator
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
agent used to scan for exposed secrets and test stolen access
C one secondary source states it
primary risk
RK07
D inferred by us from the described behaviour, reason shown
secondary risks
RK03, RK04
D inferred by us from the described behaviour, reason shown

Impact

Records exposed
16,834
C one secondary source states it
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
alleged public-sector data theft, extortion claims, a cryptocurrency exchange data exposure and bank-impersonation calls aimed at older people
C one secondary source states it
Why this severity
tier: many third parties, with a stated count of 726,989 hosts reached
D inferred by us from the described behaviour, reason shown

Notes on gaps

The year of the August vault dates is not stated. The advice controls J8 and A3 are my mapping of the recommendations. Affected third parties are reported as hosts reached, not verified victims. Marketing text in the source was ignored.

LR-2026-0728 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON