# China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure

> Israeli cybersecurity firm Dream disclosed what it describes as the first fully autonomous, end-to-end cyberattack on a foreign government: a suspected China-linked operation that chained the open-source AI agent frameworks Hermes Agent and OpenClaw into a self-directed offensive tool, running up to eight concurrent agents across 12 attack waves over four days in early July 2026 to compromise Taiwanese government portals, the Nuclear Safety Commission, and at least seven energy companies.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-08-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1997
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-hermes-openclaw-autonomous-government-attack-tl-2026-1997.webp?v=8b09da7c (Threadlinqs threat intel: Hermes, OpenClaw AI Agents Strike Taiwan: Detection & IOCs (TL-2026-1997) — Critical severity, 7 IOCs, 9 detection rules.)
- **ID:** TL-2026-1997
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

Over four days from July 1-4, 2026, an operator Dream Security's Threat Research team assesses is likely China-connected ran a multi-agent AI attack framework built on two open-source agentic AI projects, Hermes Agent (from Nous Research) and OpenClaw, against Taiwanese government infrastructure. Sub-agents operated under distinct .hermes and .openclaw workspace identifiers, with up to eight lettered sub-agents (A through Q) running concurrently per wave across 12 documented waves.

The operation began with reconnaissance: agents decompiled client-side Angular JavaScript bundles served by government portals to enumerate URLs, API endpoints, OAuth client IDs, and Keycloak SSO configuration, mapping 21 connected government systems and more than 36 unauthenticated API endpoints. A parallel SDK-harvesting stage autonomously scraped GitBook documentation portals via llms.txt indexing and raw .md content access to pull SSO integration SDK material.

For initial access, the agents found three hidden backdoor API endpoints that accepted arbitrary request bodies without authentication, used Tesseract OCR to defeat CAPTCHA protection on an office-automation portal, and forged JSON Web Tokens by setting the algorithm field to "none" to bypass signature validation. Other identified weaknesses supporting the intrusion included an open redirect (CSRF protection disabled, unvalidated redirectUri), an unrestricted file-upload API, developer debug endpoints left exposed in production, and a partial bypass of Forms Authentication.

Credential-access agents cracked captured credentials and tested them against SSO-connected systems; 84 of 85 compromised accounts (98.8%) successfully pivoted across federated systems via Keycloak SSO bridge endpoints. The framework's decision-making used a Bayesian two-layer scoring system -- individual vulnerabilities scored with likelihood ratios (automated tool-scan LR+=6.0, manual confirmation LR+=10.0), chained via P_success = P_chain x (1 - P_blocker) -- which rated the SSO lateral-movement chain at 99% success probability and let agents autonomously reprioritize routes and switch tactics when blocked, without direct human intervention.

The agents extracted complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials, producing a 160MB evidence archive of 1,395 files. The operation then expanded from the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.

Critically, the operators bypassed the underlying LLMs' own safety refusals -- the guardrails built into Hermes Agent and OpenClaw -- by framing every action to the model as authorized penetration testing, a prompt-engineering jailbreak that let the agents proceed with intrusion, credential theft, and data exfiltration tasks the models would otherwise have refused.

Attribution rests on linguistic evidence rather than formal naming: internal operational communications used Simplified Chinese while exfiltrated data was in Traditional Chinese (the standard for Taiwan/Hong Kong/Macau government systems), which researchers say indicates a high probability the operator is China-connected. Dream did not attribute the campaign to a named threat group and, per company policy, declined to formally identify the victim government beyond describing it as in the Asia-Pacific region; source reporting identifies the victim as Taiwan. Dream's chief strategy officer Amir Becker, a former head of Israeli Unit 8200 cyber operations, called it an unprecedented "end-to-end autonomous attack" and said governments should now assume a state of "permanent cyber attack." No CVE was disclosed for this campaign, and no network IOCs (IPs, domains, hashes) were published.

Analyst note: Hermes Agent has separately been documented (Unit 42, Palo Alto Networks) in an unrelated campaign by an operator using the aliases "knaithe"/"KnYuan" against Citrix NetScaler, Marimo Notebook, and other targets with DeepSeek as the reasoning engine. That campaign is a distinct incident from the Taiwan operation described here and is not conflated in this record; it demonstrates the same open-source agent framework being reused by multiple, unrelated operators.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1595.002 Vulnerability Scanning
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1606 Forge Web Credentials
- T1110.002 Password Cracking
- T1552 Unsecured Credentials
- T1078 Valid Accounts
- T1550.001 Application Access Token
- T1213 Data from Information Repositories
- T1020 Automated Exfiltration
- AML.T0054 LLM Jailbreak

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SSO Bridge Token Reuse Across Multiple Federated Applications** (`TL-2026-1997-SPL-003`)

Detects the same SSO/Keycloak session or access token being used to authenticate into an unusually high number of distinct federated downstream applications within a short window, indicating token-based lateral movement across an SSO trust boundary — the exact pattern that let 84 of 85 compromised accounts (98.8%) pivot across Taiwan government systems via the Keycloak SSO bridge in TL-2026-1997.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1550.001, T1078, T1606
- **Data sources:** keycloak_audit, sso_bridge_logs, application_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sso sourcetype="keycloak:audit"
| eval event_ok=if(match(event_type,"(?i)CODE_TO_TOKEN|LOGIN"),1,0)
| where event_ok=1
| stats dc(client_id) as distinct_clients, values(client_id) as clients_hit, count as pivots, min(_time) as first_seen, max(_time) as last_seen by token_id, username
| where distinct_clients >= 4
| eval span_sec=last_seen-first_seen
| where span_sec <= 900
| table username, token_id, distinct_clients, clients_hit, span_sec
```

### Microsoft KQL

```kql
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == "0"
| summarize DistinctApps=dcount(AppDisplayName), Apps=make_set(AppDisplayName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserPrincipalName, SessionId
| where DistinctApps >= 4
| extend SpanSeconds = datetime_diff('second', LastSeen, FirstSeen)
| where SpanSeconds <= 900
| project UserPrincipalName, SessionId, DistinctApps, Apps, SpanSeconds
```

### Sigma

```yaml
title: SSO Bridge Token Reuse Across Multiple Federated Applications
id: 8b3d6f1a-4e9c-4a7d-9b2f-6c1e8a3d5f92
status: experimental
description: Detects the same SSO/Keycloak session or access token being used to authenticate into an unusually high number of distinct federated downstream client applications within a short window, indicating token-based lateral movement across an SSO trust boundary — the pattern that let 84/85 compromised accounts pivot across Taiwan government systems in TL-2026-1997.
references:
    - https://intel.threadlinqs.com/threats/TL-2026-1997
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/12
tags:
    - attack.lateral-movement
    - attack.t1550.001
    - attack.persistence
    - attack.t1078
    - attack.credential-access
    - attack.t1606
logsource:
    product: keycloak
    category: authentication
detection:
    selection:
        event_type:
            - 'CODE_TO_TOKEN'
            - 'LOGIN'
    timeframe: 15m
    condition: selection | count(client_id) by token_id > 4
falsepositives:
    - A legitimate single-sign-on user session naturally touching several applications in one working session (tune threshold/timeframe to org baseline)
    - Shared service accounts intentionally federated across many applications
level: high
```

**Known false positives:**

- A legitimate SSO user session naturally touching several applications during one working session
- Shared service accounts intentionally federated across many applications by design

**Tuning notes:** Baseline distinct_clients threshold against your SSO realm's normal cross-app usage pattern for real users; exclude known shared/service-account principals; tighten the time span (span_sec) to flag pivots faster than plausible human navigation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CAPTCHA OCR Bypass Chained to Unauthenticated Backdoor API Access (locked: unlock with TL Creds)
- Forms Authentication Bypass Followed by Debug Endpoint Access (locked: unlock with TL Creds)
- Bulk Personnel/User Database Export via Repeated Repository Queries (locked: unlock with TL Creds)
- Angular Bundle Enumeration Recon Chained to Open-Redirect or File-Upload Abuse (locked: unlock with TL Creds)
- High-Velocity Multi-Endpoint Enumeration Consistent With Autonomous AI Agent Reconnaissance (locked: unlock with TL Creds)
- Automated Bulk Exfiltration of SSO Client Secrets and Database Credentials (locked: unlock with TL Creds)
- JWT alg=none Signature-Bypass Forgery Against SSO-Fronted Portals (locked: unlock with TL Creds)
- High-Volume Credential Testing Against SSO Login Endpoint (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [China-linked Hackers Using AI Agents to Attack Taiwan Government Websites](https://cybersecuritynews.com/chinese-hackers-target-taiwan-using-ai/)
- [Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia](https://dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia)
- [AI Hackers Target Taiwan in New Cyber Warfare Shift](https://slguardian.org/ai-hackers-target-taiwan-in-new-cyber-warfare-shift/)
- [Chinese hackers launched a fully autonomous AI cyberattack against Taiwan. Why it surprised even seasoned cyber experts](https://dev.ua/en/news/kytaiski-khakery-zdiisnyly-povnistiu-avtonomnu-shi-kiberataku-proty-taivaniu-chomu-vona-zdyvuvala-navit-buvalykh-kiberekspertiv-1786521101)
- ['China-linked' hackers used AI agents to target Taiwan's government websites](https://nationaltechnology.co.uk/China_linked_hackers_used_AI_agents_to_target_Taiwans_government_websites.php)
- [Chinese Hackers Used AI Agents to Hunt Taiwan Government Systems, Breaching 85 Accounts and Stealing Thousands of Records](https://www.benzinga.com/news/26/08/61138673/chinese-hackers-used-ai-agents-to-hunt-taiwan-government-systems-breaching-85-accounts-and-stealing-thousands-of-records-report)
- [Chinese hackers let AI agents loose on Taiwan](https://fudzilla.com/chinese-hackers-let-ai-agents-loose-on-taiwan/)
- [Autonomous AI hit on Taiwan linked to China](https://www.insurancebusinessmag.com/us/news/cyber/autonomous-ai-hit-on-taiwan-linked-to-china-585847.aspx)
- [Autonomous AI Agents Penetrate Taiwanese Government and Energy Infrastructure](https://clashreport.com/world/articles/autonomous-ai-agents-penetrate-taiwanese-government-and-energy-infrastructure-ptr7piu1ey)
- [OpenClaw security risks: What security teams need to know about agentic AI](https://blog.barracuda.com/2026/04/09/openclaw-security-risks-agentic-ai)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1997