Attacker Using DeepSeek Steals Thousands of University Records

An attacker using DeepSeek-backed Hermes Agent stole more than 5,200 student and faculty records from an Indian public university, according to Unit 42. At another university the actor mapped 12 subdomains, gathered 13 author-derived WordPress user IDs and used an AI-generated tool with 117 candidate usernames and 28 common passwords. That tool flagged one login as valid; the confirmed MongoDB exfiltration happened at the second university. A proposed VoIP fraud operation was still in planning or early setup.

On WordPress sites, correlate post-author and author-page requests with authentication failures and successful admin sessions. Enable MFA on privileged accounts and per-account login throttling, then verify that failed attempts trigger a throttle and an alert. For databases holding student records, replace weak administrator credentials, restrict MongoDB to approved application and administration hosts, and compare collection reads and outbound exports with authorized backup jobs. Check network history for actor server 162.243.3[.]92 and commercial proxy 104.238.38.202 alongside account and timing evidence. Normal author-page traffic is common, and a clean web log says little about database access: examine both credential paths.