BlackHatSect0r && DXQRTXX has been linked to an automated cybercrime operation that used an AI agent connected to a DeepSeek model to scan for exposed secrets, test stolen access, and feed results into a custom control platform.

The activity shows how common security gaps can be abused at machine speed.An exposed operation server contained 4.9 GB of material across 9,299 files, including the DXSCAN platform, phishing tools, extortion material and a vault with 16,834 credentials.

The crew queued 2,759,860 domains, reached 726,989 hosts and generated 1,374,300 IP addresses during its campaign.

SOCRadar researchers identified the infrastructure and found evidence that the French-speaking crew removed safeguards from its agent before using it across multiple campaigns.

SOCRadar said in a report shared with Cyber Security News (CSN) that the operation relied on exposed cloud storage, readable configuration files and weak secrets, rather than new vulnerabilities.

The impact extends beyond credential theft. The material links the group to alleged public-sector data theft, extortion claims, a cryptocurrency exchange data exposure and bank-impersonation calls aimed at older people.

The case adds urgency to AI agent attack automation because automation can make routine misconfigurations far more damaging.

BlackHatSect0r Uses DeepSeek-Powered AI Agent

The group ran a Nous Research Hermes agent against a DeepSeek model, controlled through a 14 KB identity file called SOUL.md.

The operator removed the agent’s refusal memory, disabled safety settings and set seven background workers to keep scanning, collecting and reporting without constant human input.

DXSCAN generated roughly 1,200 random addresses every ten seconds, checked ports 80, 443 and 8080, identified web software, and searched for more than 200 credential patterns.

BlackHatSect0r && DXQRTXX in SOCRadar platform (Source - SOCRadar) — BlackHatSect0r && DXQRTXX in SOCRadar platform (Source – SOCRadar)

When it found exposed .env files, cloud keys or database details, it stored the data and sent French-language victim reports through Telegram.

That workflow illustrates the concern raised in recent reporting on autonomous credential theft campaigns: AI did not need to invent a breakthrough exploit to cause harm.

It gave the operators persistence, speed and the ability to run reconnaissance, validation and collection in parallel. The crew marketed some tools as zero-days, but the research found no confirmed breach based on a new flaw.

Confirmed access came from public cloud buckets, exposed .env or Git files, default signing keys, or secrets placed in browser code. In one exchange case, a JWT signing secret set to “secret” exposed 418 identity records.

Exposure Gaps Fuel Credential Theft

The credential vault grew from 16,415 records on August 11 to 16,834 by August 18. It included generic secrets, database and SMTP credentials, API keys, AWS keys, GitHub tokens and Stripe keys. Of 230 SMTP configurations, 82 were verified and prepared for possible reuse as phishing relays.

The same infrastructure supported phishing that encouraged recipients to telephone an attacker-controlled number instead of clicking a harmful link.

That tactic can avoid link scanning and attachment checks, making staff awareness and call-back procedures essential. Readers tracking related threats can review AI enabled cyberattack techniques for context on how agents divide work across an intrusion.

Organizations should audit cloud storage for public read or write access, remove .env, .git, debug and actuator endpoints from the internet, and rotate every secret that may have been exposed.

The crew’s own branding (Source - SOCRadar) — The crew’s own branding (Source – SOCRadar)

Signing keys and token-generation material should remain on the server, while default or easy-to-guess values must be replaced immediately.

Defenders should also hunt for the listed infrastructure, unusual GHOST strings, SOUL.md, .hermes directories and unauthorized ngrok activity.

Web teams can flag short bursts of requests for configuration paths from one source, particularly when they follow scans of common web ports.

These checks reinforce the lessons from exposed Vite server attacks, where accessible environment files can open the door to broader compromise.

Security teams should investigate matching indicators, isolate systems, preserve logs, and review authentication activity promptly.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 server	`217.156.122[.]129`	Active DXSCAN C2 node hosted in Moldova
C2 server	`37.221.66[.]43`	Retired DXSCAN C2 node hosted in Moldova
Network ports	`8080`, `3480`, `9998`, `9999`, `4444`	C2/API, dashboard, hub and reverse-shell related ports
Telegram bot ID	`8719074836`	`@FicheCallSGBot`
Telegram bot ID	`8991452393`	`@HackAUreBOT`
Telegram bot ID	`8924646821`	Telegram-related infrastructure identifier
Telegram chat ID	`-5489653213`	Destination for automated victim reports
Cryptocurrency wallet	`bc1qg6m4733jazxca5ftc7aggdmsflwdwzlm`	Bitcoin wallet embedded in the actor’s tooling
Host artifacts	`SOUL.md`; `.hermes/`; `HERMES_DISABLE_SAFETY=1`	AI-agent framework artifacts and disabled safety setting
Credential marker	`GHOST-VAULT-`	Prefix used in credential IDs
User-agent and tool strings	`GHOST-CRED/3.0`; `GHOST-VAULT/`; `GHOST/0day`	Distinctive strings for log and endpoint hunting
Process naming	`ghost_`	Prefix associated with agent-related process names
Tunneling service	`ngrok`	Used to expose cloned phishing pages
File names	`env.4.2.0.js`; `main-NDOQMLR2.js`	Reverse-engineered client-side bundles
Phishing phone number	`+33 1 89 62 92 59`	Attacker-controlled number used in bank-impersonation calls
SHA-256	`48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf`	DXSCAN compiled C2 build
SHA-256	`0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5`	DXSCAN debug build
SHA-256	`92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f`	Related compiled C2 build
SHA-256	`8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3`	DXSCAN backup build
SHA-256	`8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9`	DXSCAN backup build
SHA-256	`db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0`	Newer compiled C2 build
SHA-256	`c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8`	Previous compiled C2 build
Weaponized CVEs	`CVE-2021-3129`; `CVE-2018-15133`; `CVE-2022-22947`; `CVE-2021-29447`; `CVE-2026-42530`	Vulnerabilities and public proof-of-concept code referenced in the toolset

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials appeared first on Cyber Security News.