An attacker using DeepSeek-backed AI tooling stole more than 5,200 student and faculty records from an Indian public university, according to Palo Alto Networks Unit 42’s investigation. At a different Indian university, the same actor used AI-generated reconnaissance and a password-guessing tool against a WordPress education site. One campaign reached a database; the other shows how quickly public author details became login targets.
Unit 42 traced both activities through the actor’s working environment. Its researchers found an exfiltration manifest beside dumped MongoDB collections at the second university. The actor’s other projects ranged from nearby Wi-Fi credential capture to a proposed phone-fraud operation. Those projects matter for triage, but the confirmed student-record loss is the immediate incident.
WordPress authors became login targets
The actor mapped 12 subdomains at the first university, including its WordPress site, learning management system, student portal and administration dashboard. Unit 42 says a Cloudflare WAF blocked direct requests to the WordPress users endpoint. The actor still recovered 13 active user IDs with real names from post-author fields and author sitemaps.
The WordPress REST API Users reference lists public-facing author identifiers in view and embed contexts; login names and email addresses are in the edit context. Public author metadata helped the actor assemble candidate identities despite the blocked users endpoint. A rule covering just that endpoint would leave author-page discovery visible.
An AI-generated tool then worked with 117 usernames derived from the reconnaissance and 28 common passwords. Unit 42 says the tool flagged one WordPress login as valid. Check whether that account was used after the flagged login. Investigate the first university’s WordPress authentication history separately from the confirmed database theft at the second university.
Weak MongoDB access led to theft
At the second Indian public university, the actor obtained an administrator account with a weak password and exfiltrated MongoDB collections. Unit 42 describes thousands of diploma, undergraduate, postgraduate and faculty records containing personal information; its conclusion puts the stolen total above 5,200 records. The exfiltration manifest also recorded cloud load balancing, edge routing, database services and a third-party cloud storage service account.
A database export is a different path from a website password guess. For a university or any operator of student records, the immediate question is which administrator credentials can reach the database, from which network segments, and whether collection reads or exports match authorized jobs. Preserve database access records and network-flow history before rotating credentials if you are investigating an actual match.
The actor reused one server
Unit 42 found that an actor using the handle BUGSTER ran Hermes Agent with DeepSeek V4 as the reasoning engine, operated several Telegram-controlled profiles and configured a Cursor IDE proxy with agent permissions loosened. The researchers describe the server at 162.243.3[.]92 as hosting the AI interface, a Python command-and-control listener and supporting components. Their indicator list also names commercial proxy 104.238.38.202. Those addresses are useful pivots in your own proxy, DNS and firewall history; match them with timestamps and affected assets before treating a connection as this actor’s activity. Palo Alto Networks also describes its own URL filtering and endpoint products as protections in this investigation; verify those vendor assessments against your deployed detections.
The toolchain let one operator move between different tasks. A Go-based scanner collected exposed .env values, S3 signed URLs, Google Cloud service-account keys, CDN API keys and private keys in log files. A nearby Kali device captured Wi-Fi authentication material for cloud GPU cracking, which required proximity to the targeted access points. Unit 42 also found bot conversations about a VoIP fraud front, carrier access and caller-ID spoofing. That phone operation was in planning or early setup: the investigators found no call logs, SIP traces or active routing. An AI-generated e-commerce report even labeled its proposed next steps “NEXT EXPLOIT OPPORTUNITIES.”
Follow the two credential paths
Start with the sites and databases your team actually runs. On WordPress properties, compare author-page and post-author requests with subsequent login failures and successful administrative sessions. Review the affected site’s authentication records around clusters of usernames and common-password attempts; a public author-page request alone is normal traffic. OWASP’s authentication guidance recommends account-based login throttling, multi-factor authentication and monitoring. Enable MFA for privileged accounts and tune per-account throttling so distributing attempts across source IPs does not sidestep the control.
For MongoDB, inventory administrator accounts, replace weak or reused credentials and restrict database reachability to the application and administrative hosts that need it. Review database access and export telemetry for bulk collection reads, then compare outbound transfers with approved backup jobs. Investigate unexpected access to student and faculty collections as a potential disclosure, even if WordPress logs are quiet. Review exposed secrets in .env files and logs and revoke any found in the affected systems; a leaked cloud key can open a separate route into the environment.
Verify access before trusting controls
Test the defenses on an authorized account: a normal MFA-protected admin login should succeed and appear in the authentication log, while repeated failed attempts against that account should trigger the configured throttle and an alert. From a workstation outside the database’s approved network paths, confirm that MongoDB cannot be reached; from an approved application host, verify a legitimate query still works and is logged. Keep the investigation’s actual timestamps, accounts and export volumes attached to those checks. One actor used AI to organize several jobs, but the losses described here still passed through ordinary credentials and reachable data stores.