Suspected China-Linked Actor Runs Near-Autonomous Multi-Agent AI Attack on Taiwan Government, Nuclear Safety Agency, and Energy Sector (Hermes + OpenClaw)

Suspected China-Linked Actor Runs Near-Autonomous (TL-2026-2063) is a critical-severity advanced persistent threat campaign, first published 2026-08-18. It is linked to a China-nexus actor with low confidence, affects Taiwan Government Government agency web portals, connected, maps to 14 MITRE ATT&CK / ATLAS techniques (AML.T0054, T1020, T1078), and is covered by 9 detection rules and 8 indicators of compromise.

Key facts for TL-2026-2063

Threat ID
TL-2026-2063
Severity
CRITICAL
Status
ACTIVE
Category
APT
First published
2026-08-18
Last reviewed
2026-08-18
Attribution confidence
LOW
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government administration, energy, nuclear, critical infrastructure
Target regions
taiwan, APAC
Detection rules
9
Indicators of compromise
8

Malware and tooling in Suspected China-Linked Actor Runs Near-Autonomous

Malware and tooling: DeepSeek-V4-Flash, Hermes, OpenClaw

Israeli cybersecurity firm Dream disclosed a four-day campaign (July 1-4, 2026) in which a suspected China-linked operator assembled an offensive multi-agent platform from the open-source frameworks Hermes (Nous Research) and OpenClaw, ran up to eight sub-agents in parallel across 12 attack waves, and bypassed the frameworks' AI safety guardrails by framing the entire operation as an authorized penetration test. The campaign compromised at least 85 Taiwan government accounts, exfiltrated 2,500+ personnel records, and expanded into Taiwan's nuclear safety agency, government IT supply-chain vendors, and at least seven energy-sector companies.

How Suspected China-Linked Actor Runs Near-Autonomous works

On August 12, 2026, Israeli AI/cyberdefense firm Dream disclosed to the Financial Times (and, subsequently, to Security Affairs and a wide field of outlets including The Register, CyberScoop, CSO Online, CNN Business, Benzinga, and Taipei Times) that it had recovered a 160MB, 1,395-file operator archive revealing what researchers describe as a 'near-autonomous' cyberattack against Taiwan government and critical-infrastructure targets. The archive showed the operator had built an offensive platform on top of two publicly available, open-source agentic-AI frameworks: Hermes (an autonomous AI-agent framework released by Nous Research in February 2026) and OpenClaw (an open-source personal AI assistant that launched in November 2025 and accumulated roughly 340,000 GitHub stars within six months). CSO Online additionally reported that the underlying language model was later identified, post-publication, as DeepSeek-V4-Flash.

The operation ran across 12 distinct 'attack waves' between July 1 and July 4, 2026, with up to eight autonomous sub-agents deployed in parallel per wave, each assigned to a distinct target or attack technique, coordinating with 'minimal human steering.' Starting from a single public-facing government portal, the agents extracted embedded URLs, API endpoints, OAuth client IDs, and Keycloak identity-provider configuration, using that foothold to map 21 connected government systems and their authentication flows. On one target alone the agents discovered 36+ unauthenticated API endpoints, including three hidden endpoints that accepted arbitrary request bodies and returned valid authenticated sessions outright. The agents also ran password-spraying rounds using patterns derived from predictable employee-ID formats and reportedly solved CAPTCHA challenges with a 100 percent success rate.

The result was compromise of at least 85 government accounts, exfiltration of 2,500+ personnel records (including a full JSON export of a department's user directory), and theft of seven SSO client secrets and six internal database credentials spanning MSSQL, Oracle, and Sybase, plus internal network IP ranges. Using the harvested SSO/OAuth material for cross-system pivoting, the platform expanded laterally into the government's IT supply-chain vendors, the government email system, Taiwan's nuclear safety agency, and at least seven energy-sector companies.

A distinguishing feature of the campaign, and the reason Dream and multiple outlets frame it as a novel escalation, is that the operators bypassed Hermes' and OpenClaw's built-in AI safety guardrails purely through prompt framing: by presenting the entire offensive operation to the agent stack as an 'authorized penetration test,' they induced the models to treat destructive, unauthorized activity as legitimate security work. Dream also documented an autonomous 'learning cycle' in which the agents independently queried vulnerability databases, GitHub repositories, and security research to identify CVEs and exploitation techniques applicable to the target environment, then adapted their attack paths when blocked, without a human in the loop directing each step.

Attribution is unconfirmed: Dream did not name a specific group or state sponsor. The attribution signal is linguistic — internal operator communications recovered in the archive were written in Simplified Chinese, while the exfiltrated data itself was in Traditional Chinese (the script used in Taiwan, Hong Kong, and Macau), leading researchers to assess a high likelihood the operator is China-connected. Taiwan's Ministry of Digital Affairs subsequently confirmed detection of the campaign. Commentators (CyberScoop, CSO Online) drew a direct comparison to Anthropic's November 2025 disclosure that it had disrupted a suspected Chinese state-sponsored campaign that manipulated Claude to attack roughly 30 international companies and government agencies; unlike that incident, investigators in the Taiwan case could not initially confirm which underlying LLM powered the Hermes/OpenClaw stack (later reported as DeepSeek-V4-Flash). No CVE identifiers or literal network indicators (IPs/domains/hashes) were disclosed in public reporting as of this writing; the campaign's signature is architectural and behavioral (multi-agent orchestration tempo, autonomous vulnerability research, guardrail-bypass framing) rather than a fixed IOC set.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2063

Defense Evasion

AML.T0054 LLM Jailbreak

Exfiltration

T1020 Automated Exfiltration

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087 Account Discovery

Credential Access

T1110.003 Brute Force: Password Spraying; T1552 Unsecured Credentials

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Resource Development

T1588.002 Obtain Capabilities: Tool; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Suspected China-Linked Actor Runs Near-Autonomous

  • Taiwan Government — Government agency web portals, connected SSO/Keycloak identity infrastructure, and personnel-record systems (21 connected systems mapped from a single portal)
    Vulnerable versions: N/A — campaign targeted live production government IT infrastructure, not a specific software version
  • Taiwan nuclear safety agency (unnamed in public reporting) — Agency network and email systems reached via lateral movement from the initial government compromise
    Vulnerable versions: N/A
  • Taiwan energy sector — Networks of at least 7 unnamed energy-sector companies reached via lateral movement
    Vulnerable versions: N/A
  • Taiwan government IT supply chain — Third-party IT vendor systems supporting government agencies
    Vulnerable versions: N/A

Remediation for Suspected China-Linked Actor Runs Near-Autonomous

Immediate actions

  • Audit all internet-facing APIs for endpoints that accept requests without authentication or return valid sessions without proper auth checks — Dream found 36+ unauthenticated endpoints, including 3 that returned valid authenticated sessions for arbitrary request bodies, on a single Taiwan government target.
  • Rotate and re-scope any SSO/OAuth client secrets and Keycloak identity-provider configuration values that are embedded in public-facing portal code — the operators harvested 7 SSO client secrets this way.
  • Enforce account lockout, rate-limiting, and anomaly detection on authentication endpoints to blunt automated password-spraying keyed to predictable employee-ID patterns.

Workarounds

  • Restrict, log, and alert on outbound activity from open-source agentic-AI frameworks (e.g., Hermes, OpenClaw) that could be repurposed for offensive automation against exposed government or critical-infrastructure endpoints.

Longer-term hardening

  • Deploy detection tuned to AI-agent-speed reconnaissance and enumeration patterns across API and auth endpoints — Silverfort's Colin Ferris noted defensive tooling has not scaled down in cost the way autonomous offensive tooling has.
  • Harden CAPTCHA/bot-mitigation controls against AI-agent solvers; Dream reported a 100 percent CAPTCHA solve rate by the attack platform.
  • Segment and continuously monitor SSO/IdP integrations so a single compromised client secret cannot be used to pivot across interconnected government, supply-chain-vendor, and critical-infrastructure systems.
  • Treat 'authorized penetration test' framing as an untrusted, spoofable instruction inside any agentic-AI deployment; require out-of-band authorization verification before an agent stack is allowed to perform offensive actions.

Timeline of Suspected China-Linked Actor Runs Near-Autonomous

  • Autonomous agents map 21 connected government systems and their authentication flows from the initial portal foothold.
  • Attack wave 1 begins: agents compromise a public-facing Taiwan government portal and begin extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak identity-provider configuration.
  • Agents begin password-spraying rounds against government accounts using patterns derived from predictable employee-ID formats, and report solving CAPTCHA challenges with 100 percent accuracy.
  • 36+ unauthenticated API endpoints identified on a single target, including 3 hidden endpoints that return valid authenticated sessions for arbitrary request bodies.
  • Operators harvest 7 SSO client secrets and 6 internal database credentials (MSSQL, Oracle, Sybase) plus internal network IP ranges for further pivoting.
  • At least 85 government accounts compromised; a full JSON export of a department's user directory is exfiltrated, part of 2,500+ stolen personnel records.
  • Final attack waves (of 12 total) expand the intrusion into government IT supply-chain vendors, the government email system, Taiwan's nuclear safety agency, and at least 7 energy-sector companies.
  • Israeli cybersecurity firm Dream discloses the campaign to the Financial Times, describing a recovered 160MB/1,395-file operator archive; Security Affairs and other outlets report the story.
  • Media coverage (CyberScoop, CSO Online, CNN Business) compares the incident to Anthropic's November 2025 disclosure of a Chinese state-sponsored campaign that manipulated Claude against ~30 organizations; CSO Online separately reports DeepSeek-V4-Flash as the underlying LLM identified post-publication.
  • Taiwan's Ministry of Digital Affairs confirms detection of the campaign as regional outlets including Taipei Times report on the incident domestically.

Sources cited for Suspected China-Linked Actor Runs Near-Autonomous

Threats related to Suspected China-Linked Actor Runs Near-Autonomous

Detection coverage for TL-2026-2063

As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2063 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats