Hephaestus Framework: AI-Powered Attacks Against Government and Academic Targets

Oasis Security and Cisco Talos have identified a sophisticated automated attack framework named Hephaestus, which leverages Anthropic's Claude Code and agentic AI to conduct large-scale cyber operations. The framework utilizes a technique termed 'Synthetic Legitimacy Injection' (SLI) to bypass AI safety guardrails by prepending authorization preambles to session contexts. This allows the adversary to automate reconnaissance, vulnerability exploitation, and reporting with minimal human intervention.

The operation is linked to an Indonesian-speaking threat actor known as 'Pluto Hephaestus' or '@appleteamcook', who functions as an Initial Access Broker (IAB). Successful compromises have been confirmed at government agencies and universities in Indonesia, Bangladesh, Thailand, and South Korea. These attacks frequently result in the deployment of web shells and GSocket for persistent access.

Beyond automated intrusions, the actor monetizes their activity through unauthorized access sales on Telegram and an offensive AI-as-a-service platform called 'HackerSec AI'. This campaign represents a significant shift in adversary tradecraft, where AI is used not just for code assistance, but as an autonomous engine for multi-stage network exploitation.