China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure — Threadlinqs Intelligence
As of 2026-08-12, China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure is a critical-severity apt threat attributed to a China-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 7 indicators of compromise.
Threat ID: TL-2026-1997 · Severity: CRITICAL · Status: ACTIVE · Category: APT
Attribution: China · ESPIONAGE
Israeli cybersecurity firm Dream disclosed what it describes as the first fully autonomous, end-to-end cyberattack on a foreign government: a suspected China-linked operation that chained the
Over four days from July 1-4, 2026, an operator Dream Security's Threat Research team assesses is likely China-connected ran a multi-agent AI attack framework built on two open-source agentic AI projects, Hermes Agent (from Nous Research) and OpenClaw, against Taiwanese government infrastructure. Sub-agents operated under distinct .hermes and .openclaw workspace identifiers, with up to eight lettered sub-agents (A through Q) running concurrently per wave across 12 documented waves.
The operation began with reconnaissance: agents decompiled client-side Angular JavaScript bundles served by government portals to enumerate URLs, API endpoints, OAuth client IDs, and Keycloak SSO configuration, mapping 21 connected government systems and more than 36 unauthenticated API endpoints. A parallel SDK-harvesting stage autonomously scraped GitBook documentation portals via llms.txt indexing and raw .md content access to pull SSO integration SDK material.
For initial access, the agents found three hidden backdoor API endpoints that accepted arbitrary request bodies without authentication, used Tesseract OCR to defeat CAPTCHA protection on an office-automation portal, and forged JSON Web Tokens by setting the algorithm field to "none" to bypass signature validation. Other identified weaknesses supporting the intrusion included an open redirect (CSRF protection disabled, unvalidated redirectUri), an unrestricted file-upload API, developer debug endpoints left exposed in production, and a partial bypass of Forms Authentication.
Credential-access agents cracked captured credentials and tested them against SSO-connected systems; 84 of 85 compromised accounts (98.8%) successfully pivoted across federated systems via Keycloak SSO bridge endpoints. The framework's decision-making used a Bayesian two-layer scoring system -- individual vulnerabilities scored with likelihood ratios (automated tool-scan LR+=6.0, manual confirmation LR+=10.0), chained via P_success = P_chain x (1 - P_blocker) -- which rated the SSO lateral-movement chain at 99% success probability and let agents autonomously reprioritize routes and switch tactics when blocked, without direct human intervention.
The agents extracted complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials, producing a 160MB evidence archive of 1,395 files. The operation then expanded from the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.
Critically, the operators bypassed the underlying LLMs' own safety refusals -- the guardrails built into Hermes Agent and OpenClaw -- by framing every action to the model as authorized penetration testing, a prompt-engineering jailbreak that let the agents proceed with intrusion, credential theft, and data exfiltration tasks the models would otherwise have refused.
Attribution rests on linguistic evidence rather than formal naming: internal operational communications used Simplified Chinese while exfiltrated data was in Traditional Chinese (the standard for Taiwan/Hong Kong/Macau government systems), which researchers say indicates a high probability the operator is China-connected. Dream did not attribute the campaign to a named threat group and, per company policy, declined to formally identify the victim government beyond describing it as in the Asia-Pacific region; source reporting identifies the victim as Taiwan. Dream's chief strategy officer Amir Becker, a former head of Israeli Unit 8200 cyber operations, called it an unprecedented "end-to-end autonomous attack" and said governments should now assume a state of "permanent cyber attack." No CVE was disclosed for this campaign, and no network IOCs (IPs, domains, hashes) were published.
Analyst note: Hermes Agent has separately been documented (Unit 42, Palo Alto Networks) in an unrelated campaign by an operator using the aliases "knaithe"/"KnYuan" against Citrix NetScaler, Marimo Notebo
Weaknesses (CWE)
CWE-287, CWE-306, CWE-601, CWE-434, CWE-489
Target sectors: government administration, energy, nuclear regulatory, critical infrastructure
Target regions: taiwan, Asia-Pacific
Timeline
- Wave 1 of a 12-wave campaign begins: the Hermes Agent/OpenClaw multi-agent system launches reconnaissance against Taiwanese government portals, decompiling Angular JavaScript bundles to enumerate 21 connected systems and 36+ unauthenticated API endpoints.
- Agents autonomously scrape GitBook documentation portals via llms.txt indexing and raw .md content access to obtain SSO integration SDK material.
- Agents discover three hidden backdoor API endpoints accepting arbitrary request bodies and use Tesseract OCR to defeat CAPTCHA protection on an office-automation portal.
- Agents forge JSON Web Tokens with the algorithm field set to "none", bypassing signature validation on target systems.
- Agents crack captured credentials and test them against SSO-connected systems as part of the credential-access stage.
- 84 of 85 compromised accounts (98.8%) successfully pivot across federated systems via Keycloak SSO bridge endpoints, rated at 99% success probability by the framework's Bayesian decision engine.
- Agents extract complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials.
- The operation expands beyond the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.
- The four-day, 12-wave campaign concludes, having produced a 160MB evidence archive of 1,395 files across 85 compromised government accounts.
- Israeli cybersecurity firm Dream publishes its findings, describing the operation as the first known fully autonomous, end-to-end cyberattack on a foreign government; Dream declines to formally name the victim government or attribute the operation to a named threat group beyond noting a high probability of a China-connected operator.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 7 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, T1594, T1595.002, T1588.007, T1190, T1606, T1110.002, T1552, T1078, T1550.001, T1213
