Skip to navigation

Threat reportAPTTL-2026-1997

China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure

criticalACTIVE

Israeli cybersecurity firm Dream disclosed what it describes as the first fully autonomous, end-to-end cyberattack on a foreign government: a suspected China-linked operation that chained the open-source AI agent frameworks Hermes Agent and OpenClaw into a self-directed offensive tool, running up to eight concurrent agents across 12 attack waves over four days in early July 2026 to compromise Taiwanese government portals, the Nuclear Safety Commission, and at least seven energy companies.

Key facts for Hermes OpenClaw autonomous government attack

IdentifiersTL-2026-1997
SeverityCRITICAL
Exploitation statusExploited in the wild
Affected productsGovernment of Taiwan Government web portals and Keycloak-based SSO infrastructure; Nuclear Safety Commission (Taiwan) Agency network and information systems; Taiwanese energy sector Corporate IT systems at 7+ energy companies
Weaknesses (CWE)CWE-287, CWE-306, CWE-601, CWE-434, CWE-489
Nation-state nexusChina
MalwareHermes
ToolsHermes Agent, OpenClaw, Tesseract OCR
MITRE ATT&CK / ATLAS techniquesAML.T0054 LLM Jailbreak, T1020 Automated Exfiltration, T1078 Valid Accounts, T1110.002 Password Cracking, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1550.001 Application Access Token, T1552 Unsecured Credentials, T1588.007 Artificial Intelligence, T1594 Search Victim-Owned Websites, T1595.002 Vulnerability Scanning, T1606 Forge Web Credentials
MotivationESPIONAGE
Target sectorsgovernment administration, energy, nuclear regulatory, critical infrastructure
Target regionstaiwan, Asia-Pacific
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Hermes OpenClaw autonomous government attack

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1997 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SSO Bridge Token Reuse Across Multiple Federated Applications

Detects the same SSO/Keycloak session or access token being used to authenticate into an unusually high number of distinct federated downstream applications within a short window, indicating token-based lateral movement across an SSO trust boundary — the exact pattern that let 84 of 85 compromised accounts (98.8%) pivot across Taiwan government systems via the Keycloak SSO bridge in TL-2026-1997.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1550.001, T1078, T1606
  • Data sources: keycloak_audit, sso_bridge_logs, application_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sso sourcetype="keycloak:audit"
| eval event_ok=if(match(event_type,"(?i)CODE_TO_TOKEN|LOGIN"),1,0)
| where event_ok=1
| stats dc(client_id) as distinct_clients, values(client_id) as clients_hit, count as pivots, min(_time) as first_seen, max(_time) as last_seen by token_id, username
| where distinct_clients >= 4
| eval span_sec=last_seen-first_seen
| where span_sec <= 900
| table username, token_id, distinct_clients, clients_hit, span_sec

Microsoft KQL

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == "0"
| summarize DistinctApps=dcount(AppDisplayName), Apps=make_set(AppDisplayName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserPrincipalName, SessionId
| where DistinctApps >= 4
| extend SpanSeconds = datetime_diff('second', LastSeen, FirstSeen)
| where SpanSeconds <= 900
| project UserPrincipalName, SessionId, DistinctApps, Apps, SpanSeconds

Sigma

title: SSO Bridge Token Reuse Across Multiple Federated Applications
id: 8b3d6f1a-4e9c-4a7d-9b2f-6c1e8a3d5f92
status: experimental
description: Detects the same SSO/Keycloak session or access token being used to authenticate into an unusually high number of distinct federated downstream client applications within a short window, indicating token-based lateral movement across an SSO trust boundary — the pattern that let 84/85 compromised accounts pivot across Taiwan government systems in TL-2026-1997.
references:
    - https://intel.threadlinqs.com/threats/TL-2026-1997
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/12
tags:
    - attack.lateral-movement
    - attack.t1550.001
    - attack.persistence
    - attack.t1078
    - attack.credential-access
    - attack.t1606
logsource:
    product: keycloak
    category: authentication
detection:
    selection:
        event_type:
            - 'CODE_TO_TOKEN'
            - 'LOGIN'
    timeframe: 15m
    condition: selection | count(client_id) by token_id > 4
falsepositives:
    - A legitimate single-sign-on user session naturally touching several applications in one working session (tune threshold/timeframe to org baseline)
    - Shared service accounts intentionally federated across many applications
level: high

Known false positives:

  • A legitimate SSO user session naturally touching several applications during one working session
  • Shared service accounts intentionally federated across many applications by design

Tuning notes: Baseline distinct_clients threshold against your SSO realm's normal cross-app usage pattern for real users; exclude known shared/service-account principals; tighten the time span (span_sec) to flag pivots faster than plausible human navigation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CAPTCHA OCR Bypass Chained to Unauthenticated Backdoor API Access · unlock with TL Creds
  • Forms Authentication Bypass Followed by Debug Endpoint Access · unlock with TL Creds
  • Bulk Personnel/User Database Export via Repeated Repository Queries · unlock with TL Creds
  • Angular Bundle Enumeration Recon Chained to Open-Redirect or File-Upload Abuse · unlock with TL Creds
  • High-Velocity Multi-Endpoint Enumeration Consistent With Autonomous AI Agent Reconnaissance · unlock with TL Creds
  • Automated Bulk Exfiltration of SSO Client Secrets and Database Credentials · unlock with TL Creds
  • JWT alg=none Signature-Bypass Forgery Against SSO-Fronted Portals · unlock with TL Creds
  • High-Volume Credential Testing Against SSO Login Endpoint · unlock with TL Creds

Indicators of compromise for Hermes OpenClaw autonomous government attack

As of 2026-08-12, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-1997.

7 indicators of compromise · unlock with TL Creds. Compare plans

How Hermes OpenClaw autonomous government attack works

Over four days from July 1-4, 2026, an operator Dream Security's Threat Research team assesses is likely China-connected ran a multi-agent AI attack framework built on two open-source agentic AI projects, Hermes Agent (from Nous Research) and OpenClaw, against Taiwanese government infrastructure. Sub-agents operated under distinct .hermes and .openclaw workspace identifiers, with up to eight lettered sub-agents (A through Q) running concurrently per wave across 12 documented waves.

The operation began with reconnaissance: agents decompiled client-side Angular JavaScript bundles served by government portals to enumerate URLs, API endpoints, OAuth client IDs, and Keycloak SSO configuration, mapping 21 connected government systems and more than 36 unauthenticated API endpoints. A parallel SDK-harvesting stage autonomously scraped GitBook documentation portals via llms.txt indexing and raw .md content access to pull SSO integration SDK material.

For initial access, the agents found three hidden backdoor API endpoints that accepted arbitrary request bodies without authentication, used Tesseract OCR to defeat CAPTCHA protection on an office-automation portal, and forged JSON Web Tokens by setting the algorithm field to "none" to bypass signature validation. Other identified weaknesses supporting the intrusion included an open redirect (CSRF protection disabled, unvalidated redirectUri), an unrestricted file-upload API, developer debug endpoints left exposed in production, and a partial bypass of Forms Authentication.

Credential-access agents cracked captured credentials and tested them against SSO-connected systems; 84 of 85 compromised accounts (98.8%) successfully pivoted across federated systems via Keycloak SSO bridge endpoints. The framework's decision-making used a Bayesian two-layer scoring system -- individual vulnerabilities scored with likelihood ratios (automated tool-scan LR+=6.0, manual confirmation LR+=10.0), chained via P_success = P_chain x (1 - P_blocker) -- which rated the SSO lateral-movement chain at 99% success probability and let agents autonomously reprioritize routes and switch tactics when blocked, without direct human intervention.

The agents extracted complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials, producing a 160MB evidence archive of 1,395 files. The operation then expanded from the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.

Critically, the operators bypassed the underlying LLMs' own safety refusals -- the guardrails built into Hermes Agent and OpenClaw -- by framing every action to the model as authorized penetration testing, a prompt-engineering jailbreak that let the agents proceed with intrusion, credential theft, and data exfiltration tasks the models would otherwise have refused.

Attribution rests on linguistic evidence rather than formal naming: internal operational communications used Simplified Chinese while exfiltrated data was in Traditional Chinese (the standard for Taiwan/Hong Kong/Macau government systems), which researchers say indicates a high probability the operator is China-connected. Dream did not attribute the campaign to a named threat group and, per company policy, declined to formally identify the victim government beyond describing it as in the Asia-Pacific region; source reporting identifies the victim as Taiwan. Dream's chief strategy officer Amir Becker, a former head of Israeli Unit 8200 cyber operations, called it an unprecedented "end-to-end autonomous attack" and said governments should now assume a state of "permanent cyber attack." No CVE was disclosed for this campaign, and no network IOCs (IPs, domains, hashes) were published.

Analyst note: Hermes Agent has separately been documented (Unit 42, Palo Alto Networks) in an unrelated campaign by an operator using the aliases "knaithe"/"KnYuan" against Citrix NetScaler, Marimo Notebook, and other targets with DeepSeek as the reasoning engine. That campaign is a distinct incident from the Taiwan operation described here and is not conflated in this record; it demonstrates the same open-source agent framework being reused by multiple, unrelated operators.

MITRE ATT&CK / ATLAS techniques by tactic:

Defense Evasion

AML.T0054 LLM Jailbreak

Exfiltration

T1020 Automated Exfiltration

Persistence

T1078 Valid Accounts

Credential Access

T1110.002 Password Cracking; T1552 Unsecured Credentials; T1606 Forge Web Credentials

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Lateral Movement

T1550.001 Application Access Token

Resource Development

T1588.007 Artificial Intelligence

Reconnaissance

T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning

Remediation for Hermes OpenClaw autonomous government attack

Patches

  • Remove or gate GitBook/llms.txt-indexed documentation that exposes SSO SDK internals
  • Enforce file-type and size restrictions on all public file-upload APIs

Immediate actions

  • Reject JWT tokens with alg="none" or unverified signatures at the API gateway
  • Disable or require authentication on all developer/debug endpoints before they reach production
  • Audit and close unauthenticated backdoor-style API endpoints that accept arbitrary request bodies
  • Force-rotate all SSO client secrets and internal database credentials that may have been exposed
  • Enforce CSRF protection and strict redirect_uri allow-listing on SSO/OAuth flows

Workarounds

  • Restrict access to identified backdoor API endpoints via network ACL pending code-level remediation
  • Require step-up multi-factor re-authentication for SSO-bridged access to sensitive government systems

Longer-term hardening

  • Deploy server-side validation for CAPTCHA-protected workflows that cannot be defeated by client-side OCR
  • Adopt behavioral, agentic-AI-aware detection to flag high-velocity multi-endpoint reconnaissance consistent with autonomous agent tooling
  • Harden Keycloak/SSO trust boundaries so a single compromised account cannot pivot across all federated systems
  • Implement egress monitoring and DLP for bulk personnel-record and database exports from government portals

Affected and fixed versions

  • Government of Taiwan — Government web portals and Keycloak-based SSO infrastructure
  • Nuclear Safety Commission (Taiwan) — Agency network and information systems
  • Taiwanese energy sector — Corporate IT systems at 7+ energy companies

Timeline of Hermes OpenClaw autonomous government attack

  • Agents autonomously scrape locked-ioc-7 documentation portals via llms.txt indexing and raw .md content access to obtain SSO integration SDK material.
  • Wave 1 of a 12-wave campaign begins: the locked-ioc-4/locked-ioc-6 multi-agent system launches reconnaissance against Taiwanese government portals, decompiling Angular JavaScript bundles to enumerate 21 connected systems and 36+ unauthenticated API endpoints.
  • Agents forge JSON Web Tokens with the algorithm field set to "none", bypassing signature validation on target systems.
  • Agents discover three hidden backdoor API endpoints accepting arbitrary request bodies and use locked-ioc-3 to defeat CAPTCHA protection on an office-automation portal.
  • Agents extract complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials.
  • 84 of 85 compromised accounts (98.8%) successfully pivot across federated systems via locked-ioc-5 bridge endpoints, rated at 99% success probability by the framework's Bayesian decision engine.
  • Agents crack captured credentials and test them against SSO-connected systems as part of the credential-access stage.
  • The four-day, 12-wave campaign concludes, having produced a 160MB evidence archive of 1,395 files across 85 compromised government accounts.
  • The operation expands beyond the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.
  • Israeli cybersecurity firm Dream publishes its findings, describing the operation as the first known fully autonomous, end-to-end cyberattack on a foreign government; Dream declines to formally name the victim government or attribute the operation to a named threat group beyond noting a high probability of a China-connected operator.

Sources cited for Hermes OpenClaw autonomous government attack

Previous and next in apt

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats