# Suspected China-Linked Actor Runs Near-Autonomous AI Agent Campaign (Hermes/OpenClaw) Against Taiwan Government, Nuclear Safety Agency, and Energy Sector

> Israeli cybersecurity firm Dream disclosed what researchers describe as the first observed end-to-end near-autonomous AI cyberattack on a government target: over four days in early July 2026, an attacker assembled from the open-source Hermes and OpenClaw AI agent frameworks deployed up to eight agents in parallel, mapping 21 Taiwanese government systems, compromising at least 85 accounts, and extracting 2,500+ personnel records before expanding into a nuclear safety agency, a government email system, IT supply-chain vendors, and 7+ energy companies. The operator's own documentation, written in Simplified Chinese, gives researchers a high-confidence but unconfirmed China-nexus assessment.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-08-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1998
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-hermes-openclaw-taiwan-attack-tl-2026-1998.webp?v=907cfdee (Threadlinqs threat intel: Hermes/OpenClaw Taiwan Multi-Agent Attack: Detection & IOCs (TL-2026-1998) — Critical severity, 9 IOCs, 9 detection rules.)
- **ID:** TL-2026-1998
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Dream, an Israeli cyberdefense firm founded by NSO Group co-founder Shalev Hulio, uncovered the campaign while conducting broader threat-tracking work and found an exposed operational archive — roughly 160MB across ~1,395 files — that documented how the operator built an autonomous hacking platform out of two publicly available, legitimate open-source AI agent frameworks: Hermes (an agentic execution framework that can be wired to an arbitrary LLM and given terminal access, internet search, and tool-invocation capability) and OpenClaw (a self-hosted personal AI agent, formerly branded Clawdbot/Moltbot, built for autonomous multi-step task completion). Over a four-day window in early July 2026 the combined platform ran largely on its own, at times running as many as eight agent instances in parallel, mapping 21 Taiwanese government systems and continuously ranking and reprioritizing attack paths.

Dream's CSO, Amir Becker (former head of Israel's Unit 8200 cyber operations), said he had 'never before seen such an end-to-end autonomous attack' on government infrastructure, describing the tool's behavior as resembling a coordinated human red team rather than a single automated script. The archive documented recurring 'Learning Cycles': whenever an attack path was blocked, an agent would independently search public vulnerability databases, GitHub repositories, and security-research publications for new exploitable techniques, then resume the operation with minimal operator input. The platform compromised at least 85 government accounts and extracted more than 2,500 personnel records before expanding beyond the initial 21 systems into Taiwan's nuclear safety agency, a government email system, government IT supply-chain vendors, and at least seven energy-sector companies — scanning the newly identified targets in parallel for misconfigurations and exploitable vulnerabilities.

A key technical finding is how the operator kept the agent framework's own safety controls from blocking the operation: rather than exploiting a flaw in a target system, the operator got the underlying AI model to treat the entire intrusion as an authorized penetration-testing engagement, a jailbreak-by-pretext that let the agents execute clearly unauthorized actions without triggering built-in guardrails. This mirrors a broader dual-use risk that Chinese authorities themselves had already flagged: in March 2026, Beijing restricted OpenClaw at state-run enterprises and government agencies, citing a 'lethal trifecta' of broad private-data access, external communication capability, and exposure to untrusted content, months before OpenClaw resurfaced as a component of this attack platform. Attribution rests on circumstantial but consistent evidence rather than a formal claim: the operator's internal documentation was written in Simplified Chinese while data samples extracted from Taiwan's Traditional-Chinese-language government systems appeared in the same archive; researchers told the Financial Times this makes a China-linked operator likely, though Beijing has not commented and no specific group or individual has been named. Taiwan's Ministry of Digital Affairs declined to comment on the specific incident, citing confidentiality, and said any incidents affecting government agencies or critical infrastructure are handled under standard reporting and response procedures; Taiwan's National Security Bureau separately reported facing an average of roughly 2.6 million Chinese-origin cyberattacks per day in 2025.

This is not an isolated data point: on August 3, 2026, Palo Alto Networks' Unit 42 separately disclosed an unrelated but technically adjacent case in which a Chinese-speaking operator (aliases 'knaithe'/'KnYuan', assessed as based in Zhuhai) wired the DeepSeek model into the same open-source Hermes agent framework and let it autonomously scan and attack 460+ internet-facing systems worldwide via Telegram-issued instructions, confirming three compromises via CVE-2026-3055 in Citrix NetScaler before an agent misconfiguration exposed the attacker's own environment. That campaign targeted opportunistic internet-wide victims rather than a specific government, and was discovered independently by a different firm — it is a distinct threat, not the same operation — but it corroborates that the Hermes framework specifically is being actively weaponized for autonomous offensive operations by more than one operator, and that the AI-orchestrated-attack pattern first surfaced in this Taiwan campaign is part of an emerging class of activity rather than a one-off.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1588.002 Obtain Capabilities: Tool
- T1588.005 Obtain Capabilities: Exploits
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1020 Automated Exfiltration
- AML.T0054 LLM Jailbreak

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AI-Orchestrated Parallel Vulnerability Scanning Burst** (`TL-2026-1998-SPL-001`)

Detects a single source IP/identity generating high-volume scanning traffic against an unusually high number of distinct destination hosts/paths within a short window, consistent with an AI-agent framework (Hermes/OpenClaw-class) running up to 8 parallel reconnaissance/vulnerability-scanning instances rather than a single scripted scanner or human operator, as observed mapping 21 Taiwanese government systems in the source campaign.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595, T1595.002
- **Data sources:** proxy, firewall, waf
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=firewall (sourcetype=squid OR sourcetype=pan:traffic OR sourcetype=cisco:asa)
| bin _time span=5m
| stats dc(dest_ip) as unique_targets, dc(uri_path) as unique_paths, count as req_count by src_ip, _time
| where unique_targets>=8 AND req_count>200
| eval scan_rate=round(req_count/300,2)
| where scan_rate>5
| table _time src_ip unique_targets unique_paths req_count scan_rate
| sort -req_count
```

### Microsoft KQL

```kql
let ScanWindow = 5m;
union AzureNetworkAnalytics_CL, CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend SrcIP = coalesce(SrcIP_s, SourceIP), DstIP = coalesce(DestIP_s, DestinationIP)
| summarize UniqueTargets=dcount(DstIP), ReqCount=count() by SrcIP, bin(TimeGenerated, ScanWindow)
| where UniqueTargets >= 8 and ReqCount > 200
| extend ScanRate = round(ReqCount/300.0, 2)
| where ScanRate > 5
| project TimeGenerated, SrcIP, UniqueTargets, ReqCount, ScanRate
| order by ReqCount desc
```

### Sigma

```yaml
title: AI-Orchestrated Parallel Vulnerability Scanning Burst
id: 7f3a1c2e-9b44-4e2a-8d61-1a2f3c4d5e6f
status: experimental
description: Detects a single source generating high-volume, high-target-diversity scan traffic within a short window, consistent with parallel AI-agent-driven reconnaissance (Hermes/OpenClaw-class frameworks).
references:
    - https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/
    - https://attack.mitre.org/techniques/T1595/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-12
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.t1595.002
    - attack.tool.hermes
    - attack.tool.openclaw
logsource:
    category: proxy
    product: generic
detection:
    selection:
        c-uri|contains:
            - '/admin'
            - '/api'
            - '/.git'
            - '/wp-login'
    timeframe: 5m
    condition: selection | count(dst_ip) by src_ip >= 8
falsepositives:
    - Authorized vulnerability scanners (Nessus, Qualys, Rapid7)
    - CDN/load-balancer health checks
level: high
```

**Known false positives:**

- Authorized vulnerability-management scanners (Nessus/Qualys/Rapid7) — allowlist known scanner source IPs/service accounts
- Legitimate load-balancer or CDN health-check traffic touching many backend hosts

**Tuning notes:** Baseline per-source unique_targets and req_count over a rolling 7-day window per environment; raise the unique_targets/scan_rate thresholds in large enterprise/govt environments with routine internal scanning, and exclude known vulnerability-management platform service accounts/IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- LLM Jailbreak via 'Authorized Penetration Test' Pretext (locked: unlock with TL Creds)
- Machine-Paced Parallel Remote System Discovery (AI Agent Swarm Signature) (locked: unlock with TL Creds)
- Automated Bulk Exfiltration at Machine Cadence (locked: unlock with TL Creds)
- Anomalous Vendor/Trusted-Relationship Account First-Access to Government Network Segment (locked: unlock with TL Creds)
- Mass Automated Access to Personnel-Records Information Repository (locked: unlock with TL Creds)
- Autonomous Agent Capability Acquisition ('Learning Cycle') Outbound Pattern (locked: unlock with TL Creds)
- Mass Account Discovery Preceding Unsecured Credential Access (locked: unlock with TL Creds)
- Cross-Segment Lateral Movement via Compromised Valid Accounts (Govt → Nuclear → Energy) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Researchers observe first 'near-autonomous' AI attack on government target in Taiwan](https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/)
- [China-linked Hackers Using AI Agents to Attack Taiwan Government Websites](https://cybersecuritynews.com/chinese-hackers-target-taiwan-using-ai/)
- [Open-source AI Agents Autonomously Breach Taiwan Government, Mapping 21 Systems and Stealing 2,500 Records](https://www.winzheng.com/en/article/ai-agents-autonomous-taiwan-government-hack)
- [Autonomous AI hit on Taiwan linked to China](https://www.insurancebusinessmag.com/us/news/cyber/autonomous-ai-hit-on-taiwan-linked-to-china-585847.aspx)
- [Autonomous AI agents hacked the Taiwan government in a cyber first](https://www.metacurity.com/autonomous-ai-agents-hacked-the-taiwan-government-in-a-cyber-first/)
- [Chinese Hackers Used AI Agents to Hunt Taiwan Government Systems, Breaching 85 Accounts and Stealing Thousands of Records](https://www.benzinga.com/news/26/08/61138673/chinese-hackers-used-ai-agents-to-hunt-taiwan-government-systems-breaching-85-accounts-and-stealing-thousands-of-records-report)
- [China scrambles to curb OpenClaw AI at agencies](https://www.taipeitimes.com/News/front/archives/2026/03/12/2003853672)
- [Financial Times (@FT) — original disclosure of the Dream research on X](https://x.com/FT/status/2087396144246640950)
- [Suspected China-linked hackers used AI to run the first-ever end-to-end autonomous cyberattack on Taiwan's government, Israeli firm says](https://www.tomshardware.com/tech-industry/cyber-security/suspected-china-linked-hackers-used-ai-to-run-the-first-ever-end-to-end-autonomous-cyberattack-on-taiwans-government-israeli-firm-says-open-source-built-tool-continuously-devised-effective-hack-strategies-in-real-time)
- [Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers (related precedent — same Hermes framework, different operator/campaign)](https://www.helpnetsecurity.com/2026/08/03/deepseek-ai-autonomous-cyberattacks-hermes-agent/)
- [Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (related precedent — same Hermes framework, different operator/campaign)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)
- ['China-linked' hackers used AI agents to target Taiwan's government websites](https://nationaltechnology.co.uk/China_linked_hackers_used_AI_agents_to_target_Taiwans_government_websites.php)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1998