Suspected China-Linked Actor Runs Near-Autonomous AI Agent Campaign (Hermes/OpenClaw) Against Taiwan Government, Nuclear Safety Agency, and Energy Sector

Key facts for Hermes/OpenClaw Taiwan attack

Detection coverage for Hermes/OpenClaw Taiwan attack

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1998 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AI-Orchestrated Parallel Vulnerability Scanning Burst

Detects a single source IP/identity generating high-volume scanning traffic against an unusually high number of distinct destination hosts/paths within a short window, consistent with an AI-agent framework (Hermes/OpenClaw-class) running up to 8 parallel reconnaissance/vulnerability-scanning instances rather than a single scripted scanner or human operator, as observed mapping 21 Taiwanese government systems in the source campaign.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1595, T1595.002
• Data sources: proxy, firewall, waf
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall (sourcetype=squid OR sourcetype=pan:traffic OR sourcetype=cisco:asa)
| bin _time span=5m
| stats dc(dest_ip) as unique_targets, dc(uri_path) as unique_paths, count as req_count by src_ip, _time
| where unique_targets>=8 AND req_count>200
| eval scan_rate=round(req_count/300,2)
| where scan_rate>5
| table _time src_ip unique_targets unique_paths req_count scan_rate
| sort -req_count

Microsoft KQL

let ScanWindow = 5m;
union AzureNetworkAnalytics_CL, CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend SrcIP = coalesce(SrcIP_s, SourceIP), DstIP = coalesce(DestIP_s, DestinationIP)
| summarize UniqueTargets=dcount(DstIP), ReqCount=count() by SrcIP, bin(TimeGenerated, ScanWindow)
| where UniqueTargets >= 8 and ReqCount > 200
| extend ScanRate = round(ReqCount/300.0, 2)
| where ScanRate > 5
| project TimeGenerated, SrcIP, UniqueTargets, ReqCount, ScanRate
| order by ReqCount desc

Sigma

title: AI-Orchestrated Parallel Vulnerability Scanning Burst
id: 7f3a1c2e-9b44-4e2a-8d61-1a2f3c4d5e6f
status: experimental
description: Detects a single source generating high-volume, high-target-diversity scan traffic within a short window, consistent with parallel AI-agent-driven reconnaissance (Hermes/OpenClaw-class frameworks).
references:
    - https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/
    - https://attack.mitre.org/techniques/T1595/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-12
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.t1595.002
    - attack.tool.hermes
    - attack.tool.openclaw
logsource:
    category: proxy
    product: generic
detection:
    selection:
        c-uri|contains:
            - '/admin'
            - '/api'
            - '/.git'
            - '/wp-login'
    timeframe: 5m
    condition: selection | count(dst_ip) by src_ip >= 8
falsepositives:
    - Authorized vulnerability scanners (Nessus, Qualys, Rapid7)
    - CDN/load-balancer health checks
level: high

Known false positives:

• Authorized vulnerability-management scanners (Nessus/Qualys/Rapid7) — allowlist known scanner source IPs/service accounts
• Legitimate load-balancer or CDN health-check traffic touching many backend hosts

Tuning notes: Baseline per-source unique_targets and req_count over a rolling 7-day window per environment; raise the unique_targets/scan_rate thresholds in large enterprise/govt environments with routine internal scanning, and exclude known vulnerability-management platform service accounts/IPs.

• 🔒 LLM Jailbreak via 'Authorized Penetration Test' Pretext · unlock with TL Creds
• 🔒 Machine-Paced Parallel Remote System Discovery (AI Agent Swarm Signature) · unlock with TL Creds
• 🔒 Automated Bulk Exfiltration at Machine Cadence · unlock with TL Creds
• 🔒 Anomalous Vendor/Trusted-Relationship Account First-Access to Government Network Segment · unlock with TL Creds
• 🔒 Mass Automated Access to Personnel-Records Information Repository · unlock with TL Creds
• 🔒 Autonomous Agent Capability Acquisition ('Learning Cycle') Outbound Pattern · unlock with TL Creds
• 🔒 Mass Account Discovery Preceding Unsecured Credential Access · unlock with TL Creds
• 🔒 Cross-Segment Lateral Movement via Compromised Valid Accounts (Govt → Nuclear → Energy) · unlock with TL Creds

Indicators of compromise for Hermes/OpenClaw Taiwan attack

As of 2026-08-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-1998.

How Hermes/OpenClaw Taiwan attack works

The operator's own documentation, written in Simplified Chinese, gives researchers a high-confidence but unconfirmed China-nexus assessment.

Dream, an Israeli cyberdefense firm founded by NSO Group co-founder Shalev Hulio, uncovered the campaign while conducting broader threat-tracking work and found an exposed operational archive — roughly 160MB across ~1,395 files — that documented how the operator built an autonomous hacking platform out of two publicly available, legitimate open-source AI agent frameworks: Hermes (an agentic execution framework that can be wired to an arbitrary LLM and given terminal access, internet search, and tool-invocation capability) and OpenClaw (a self-hosted personal AI agent, formerly branded Clawdbot/Moltbot, built for autonomous multi-step task completion). Over a four-day window in early July 2026 the combined platform ran largely on its own, at times running as many as eight agent instances in parallel, mapping 21 Taiwanese government systems and continuously ranking and reprioritizing attack paths.

Dream's CSO, Amir Becker (former head of Israel's Unit 8200 cyber operations), said he had 'never before seen such an end-to-end autonomous attack' on government infrastructure, describing the tool's behavior as resembling a coordinated human red team rather than a single automated script. The archive documented recurring 'Learning Cycles': whenever an attack path was blocked, an agent would independently search public vulnerability databases, GitHub repositories, and security-research publications for new exploitable techniques, then resume the operation with minimal operator input. The platform compromised at least 85 government accounts and extracted more than 2,500 personnel records before expanding beyond the initial 21 systems into Taiwan's nuclear safety agency, a government email system, government IT supply-chain vendors, and at least seven energy-sector companies — scanning the newly identified targets in parallel for misconfigurations and exploitable vulnerabilities.

A key technical finding is how the operator kept the agent framework's own safety controls from blocking the operation: rather than exploiting a flaw in a target system, the operator got the underlying AI model to treat the entire intrusion as an authorized penetration-testing engagement, a jailbreak-by-pretext that let the agents execute clearly unauthorized actions without triggering built-in guardrails. This mirrors a broader dual-use risk that Chinese authorities themselves had already flagged: in March 2026, Beijing restricted OpenClaw at state-run enterprises and government agencies, citing a 'lethal trifecta' of broad private-data access, external communication capability, and exposure to untrusted content, months before OpenClaw resurfaced as a component of this attack platform. Attribution rests on circumstantial but consistent evidence rather than a formal claim: the operator's internal documentation was written in Simplified Chinese while data samples extracted from Taiwan's Traditional-Chinese-language government systems appeared in the same archive; researchers told the Financial Times this makes a China-linked operator likely, though Beijing has not commented and no specific group or individual has been named. Taiwan's Ministry of Digital Affairs declined to comment on the specific incident, citing confidentiality, and said any incidents affecting government agencies or critical infrastructure are handled under standard reporting and response procedures; Taiwan's National Security Bureau separately reported facing an average of roughly 2.6 million Chinese-origin cyberattacks per day in 2025.

This is not an isolated data point: on August 3, 2026, Palo Alto Networks' Unit 42 separately disclosed an unrelated but technically adjacent case in which a Chinese-speaking operator (aliases 'knaithe'/'KnYuan', assessed as based in Zhuhai) wired the DeepSeek model into the same open-source Hermes agent framework and let it autonomously scan and attack 460+ internet-facing systems worldwide via Telegram-issued instructions, confirming three compromises via CVE-2026-3055 in Citrix NetScaler before an agent misconfiguration exposed the attacker's own environment. That campaign targeted opportunistic internet-wide victims rather than a specific government, and was discovered independently by a different firm — it is a distinct threat, not the same operation — but it corroborates that the Hermes framework specifically is being actively weaponized for autonomous offensive operations by more than one operator, and that the AI-orchestrated-attack pattern first surfaced in this Taiwan campaign is part of an emerging class of activity rather than a one-off.

MITRE ATT&CK / ATLAS techniques by tactic:

Defense Evasion

AML.T0054 LLM Jailbreak

Discovery

T1018 Remote System Discovery; T1087 Account Discovery

Exfiltration

T1020 Automated Exfiltration

Lateral Movement

T1021 Remote Services

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Collection

T1213 Data from Information Repositories

Credential Access

T1552 Unsecured Credentials

Resource Development

T1588.002 Obtain Capabilities: Tool; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595 Active Scanning; T1595.002 Vulnerability Scanning

Remediation for Hermes/OpenClaw Taiwan attack

Immediate actions

• Audit and inventory any self-hosted agentic AI tools (OpenClaw, Hermes, or similar frameworks) present on government and critical-infrastructure networks; treat unmanaged agentic AI deployments as high-risk software supply chain, consistent with China's own March 2026 domestic restriction of OpenClaw over 'lethal trifecta' risk.
• Force credential resets and MFA re-enrollment across all accounts on the affected Taiwanese government systems and any IT supply-chain vendor accounts with access into those networks.
• Hunt for anomalous, high-velocity, multi-target reconnaissance consistent with parallel AI-agent orchestration — near-simultaneous scanning/probing of 8+ distinct hosts originating from a single operator context or automation pipeline.
• Review and tighten network segmentation between core government IT, the nuclear safety regulator, government email infrastructure, and energy-sector partner networks to blunt further trusted-relationship pivoting.

Workarounds

• Where feasible, block or tightly firewall outbound network access for self-hosted AI agent frameworks (OpenClaw, Hermes, and similar) running on government network segments pending a formal security review.

Longer-term hardening

• Deploy behavioral/EDR detection tuned to autonomous multi-agent activity signatures (bursty parallel connections, machine-paced request timing, rapid tactic-switching after being blocked) rather than relying solely on static IOC matching.
• Establish a formal AI-agent usage policy and inventory for government and critical-infrastructure networks, including mandatory jailbreak-resistance and guardrail evaluation before any agentic AI tool is approved for internal or vendor use.
• Build detection content for 'authorized-pentest' or roleplay-pretext framing appearing in inbound automation traffic, internal LLM API logs, or agent tool-invocation logs to catch jailbreak attempts (MITRE ATLAS AML.T0054).
• Establish cross-sector threat-sharing between government CERT, the nuclear safety regulator, and the energy-sector ISAC given the confirmed cross-sector expansion pattern demonstrated in this campaign.

Affected and fixed versions

• Government of Taiwan — Government agency networks and personnel-records systems
  Vulnerable versions: 21 systems mapped; at least 85 accounts compromised; 2,500+ personnel records exfiltrated
• Taiwan nuclear safety regulatory agency — Agency network (secondary expansion target)
  Vulnerable versions: targeted during campaign expansion; specific compromise scope not publicly disclosed
• Unnamed government IT supply-chain vendors — Third-party IT services to the Taiwan government
  Vulnerable versions: targeted via trusted-relationship expansion from the core government compromise
• Multiple (unnamed) — 7+ Taiwan energy-sector companies
  Vulnerable versions: scanned in parallel for misconfigurations/vulnerabilities during expansion phase

Timeline of Hermes/OpenClaw Taiwan attack

• 2026-03-12 China issues internal notices restricting/banning locked-ioc-7 at state-run enterprises and government agencies over a 'lethal trifecta' security risk (broad private-data access, external communication capability, exposure to untrusted content) — months before locked-ioc-7 resurfaces as a component of the attack platform used against Taiwan.
• 2026-07-01 Attacker begins a four-day near-autonomous campaign against Taiwanese government networks using a platform built from the locked-ioc-8 and locked-ioc-7 open-source AI agent frameworks (exact start date not disclosed by locked-ioc-9; early July 2026 per reporting).
• 2026-07-02 Up to eight AI agent instances operate in parallel, mapping 21 Taiwanese government systems and continuously ranking/reprioritizing attack paths, with agents self-researching new techniques via 'Learning Cycles' whenever blocked.
• 2026-07-03 Operation expands beyond the initial 21 government systems into Taiwan's nuclear safety agency, a government email system, government IT supply-chain vendors, and 7+ energy-sector companies, scanning each in parallel for misconfigurations.
• 2026-07-04 Approximate end of the four-day near-autonomous operation window; at least 85 government accounts compromised and 2,500+ personnel records extracted over the course of the campaign.
• 2026-08-01 locked-ioc-9 researchers uncover an exposed ~160MB archive of ~1,395 files documenting the operator's platform and campaign during broader threat-tracking work (exact discovery date not disclosed; disclosed prior to the August 12, 2026 public report).
• 2026-08-12 Taiwan's Ministry of Digital Affairs declines to comment on the specific incident, citing confidentiality, and states that incidents affecting government agencies or critical infrastructure are handled per standard reporting and response procedures.
• 2026-08-12 Financial Times, CyberScoop, and other outlets publish the first public reporting on locked-ioc-9's findings; locked-ioc-9 CSO Amir Becker describes it as the first 'end-to-end autonomous attack' he has seen on a government target.

Sources cited for Hermes/OpenClaw Taiwan attack

• Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers (related precedent — same Hermes framework, different operator/campaign) Help Net Security · Research · 2026-08-03
• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (related precedent — same Hermes framework, different operator/campaign) Unit 42 · Vendor report · 2026-08-03
• Autonomous AI agents hacked the Taiwan government in a cyber first metacurity.com · Blog · 2026-08-12
• Researchers observe first 'near-autonomous' AI attack on government target in Taiwan cyberscoop.com · News · 2026-08-12
• China-linked Hackers Using AI Agents to Attack Taiwan Government Websites cybersecuritynews.com · News · 2026-08-12
• Open-source AI Agents Autonomously Breach Taiwan Government, Mapping 21 Systems and Stealing 2,500 Records winzheng.com · News · 2026-08-12
• Autonomous AI hit on Taiwan linked to China insurancebusinessmag.com · News · 2026-08-12
• Chinese Hackers Used AI Agents to Hunt Taiwan Government Systems, Breaching 85 Accounts and Stealing Thousands of Records benzinga.com · News · 2026-08-12
• China scrambles to curb OpenClaw AI at agencies taipeitimes.com · News · 2026-03-12
• Financial Times (@FT) — original disclosure of the Dream research on X x.com · News · 2026-08-12
• Suspected China-linked hackers used AI to run the first-ever end-to-end autonomous cyberattack on Taiwan's government, Israeli firm says tomshardware.com · News · 2026-08-12
• 'China-linked' hackers used AI agents to target Taiwan's government websites nationaltechnology.co.uk · News · 2026-08-12

Threats related to Hermes/OpenClaw Taiwan attack

• China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure

Previous and next in apt

• Kimsuky 'Operation GitPower' Integrates Local AI Tooling into AsyncRAT Espionage Campaign Next report