AI-agent-coordinated attacks and 575+ malicious OpenClaw skills delivering malware (Acronis TRU Cyber Pulse 2026)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5615 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gitea diffpatch RCE (CVE-2026-60004) - Gitea Service Spawning Shell, Downloader or post-index-change Hook (Red Heron)

Detects exploitation of the Gitea diffpatch RCE CVE-2026-60004 as used by Red Heron (TL-2026-5615). The crafted patch lands a payload in hooks/post-index-change, which executes as the Gitea service account. The rule fires when the gitea process (or a post-index-change hook, which is not a standard Git hook) spawns a shell, interpreter or downloader, the post-exploitation behaviour that precedes SSH key planting and JITTERLY deployment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004
• Data sources: sysmon_for_linux, microsoft_defender_endpoint_linux
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h (ParentImage="*/gitea" OR ParentImage="*/gitea-web" OR ParentCommandLine="*/hooks/post-index-change*" OR CommandLine="*/hooks/post-index-change*") (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/python3" OR Image="*/perl")
| fillnull value="unknown" ParentImage Image CommandLine ParentCommandLine User
| eval cve="CVE-2026-60004", campaign="Red Heron"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmds values(User) as users by host ParentImage Image cve campaign
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('gitea', 'gitea-web') or InitiatingProcessCommandLine has '/hooks/post-index-change' or ProcessCommandLine has '/hooks/post-index-change'
| where FileName in~ ('sh', 'bash', 'dash', 'curl', 'wget', 'nc', 'ncat', 'python3', 'perl')
| extend CVE = 'CVE-2026-60004', Campaign = 'Red Heron'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, CVE, Campaign
| order by Timestamp desc

Sigma

title: Gitea Service Spawning Shell or Downloader - CVE-2026-60004 diffpatch RCE
id: 7c1d3f52-9b0e-4a6d-8f21-3e5a1c7b9d01
status: experimental
description: Detects the Gitea service spawning shells, interpreters or downloaders, or execution of a post-index-change repository hook, consistent with exploitation of the Gitea diffpatch RCE CVE-2026-60004 by Red Heron.
references:
    - https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/
    - https://labs.cloudsecurityalliance.org/research/csa-research-note-red-heron-gitea-rce-campaign-20260916-csa/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026-60004
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/gitea'
            - '/gitea-web'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/python3'
            - '/perl'
    selection_hook:
        CommandLine|contains: '/hooks/post-index-change'
    condition: (selection_parent and selection_child) or selection_hook
falsepositives:
    - Custom Gitea webhooks or server-side hooks that intentionally invoke shell scripts
    - Gitea administrators running maintenance scripts under the service account
level: high

Known false positives:

• Legitimate server-side Git hooks or Gitea webhook scripts that call sh/bash/curl
• Administrators running maintenance scripts as the gitea service account

Tuning notes: Baseline legitimate hook scripts per repository and allowlist their exact CommandLine paths. Treat any execution of hooks/post-index-change as high fidelity because it is not a standard Git hook. Adjust the Gitea binary name or path if the service runs under a custom name, and correlate with POST requests to /_diffpatch/ in reverse-proxy logs. Patch to Gitea 1.27.1 and disable open registration.

• 🔒 Malicious OpenClaw Skill Lure - ClawHub-DependencyInstaller and OpenClaw GitHub Release Archives (Windows) · unlock with TL Creds
• 🔒 OpenClaw Windows Loader Persistence - AppData Scheduled Task, Run Key, Defender Exclusion and svchost.exe Masquerade · unlock with TL Creds
• 🔒 OpenClaw Malware Infrastructure - [indicator] Miner C2, AMOS [indicator], Telegram Dead-Drop and Community Sibling Domains · unlock with TL Creds
• 🔒 macOS AMOS Stealer Delivery - Base64 Piped to Shell, xattr Quarantine Strip and [indicator] · unlock with TL Creds
• 🔒 Red Heron Linux Persistence - Planted SSH authorized_keys and Fake systemd-network-helper Service · unlock with TL Creds
• 🔒 Ransomware Recovery Inhibition - Shadow Copy Deletion, Backup Catalog Removal and bcdedit Recovery Tampering (Qilin, INC, LockBit 5.0) · unlock with TL Creds
• 🔒 SIXZUT LD_PRELOAD Rootkit - /etc/ld.so.preload, [indicator] and JITTERLY Artifacts · unlock with TL Creds
• 🔒 JITTERLY / Adaptix C2 Infrastructure - [indicator]:8082, Staging [indicator]:8888 and Beacon Regularity · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-5615.

Sample indicators (3 of 35)

• IP address: 91.92.242[.]30
• Domain: velvet-parrot[.]com
• URL: hxxps://t[.]me/dusty_vintage

Defanged, TLP:CLEAR. Full set of 35 indicators: unlock with TL Creds.

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The report also covers an operator coordinating attacks with AI agents (BOSSAI), TamperedChef signed applications, and ransomware (Qilin, The Gentlemen, LockBit 5.0, INC) that disables defenses and recovery.

Acronis Threat Research Unit's 2026 Cyber Pulse reporting, as summarized by Help Net Security, describes cybercriminals using AI agents to coordinate attacks, stolen credentials and sessions to reach linked services, and tooling that interferes with detection and recovery.

AI supply chain: Acronis identified more than 575 malicious OpenClaw skills on ClawHub published by 13 developer accounts; two accounts (hightower6eu with 334 skills and sakaen736jih with 199) account for about 93 percent. Skills pose as utilities (for example a YouTube transcript summarizer that requires an 'OpenClawDriver' to be installed first). Windows victims are told to download a password-protected archive from GitHub or MediaFire (ClawHub-DependencyInstaller.zip with a 'README BEFORE INSTALLING.txt'); macOS victims are told to run a base64-encoded command piped to bash that fetches the AMOS stealer from 91.92.242.30 and strips quarantine with xattr -c. The Windows loader is packed with VMProtect, decrypts strings with a 30-byte XOR key, resolves APIs dynamically, runs payloads in memory via NT APIs, injects into explorer.exe with a watchdog, persists via hidden %APPDATA% directories, scheduled tasks, a Run key and Windows Defender exclusions, and delivers a cryptominer masquerading as svchost.exe from velvet-parrot.com. A Telegram bot (t.me/dusty_vintage) acts as a dead-drop resolver. Skills can also pair instructions with executable code that uses permissions the agent already holds, and Acronis documents indirect prompt injection as a technique. Acronis also documented malicious payloads disguised as models, datasets and AI applications on Hugging Face (ITHKRPAW campaign against Vietnamese/financial targets via LNK and Cloudflare Workers PowerShell dropper; FAKESECURITY fake Windows Defender).

Red Heron: Acronis assesses with moderate confidence that a Chinese-speaking operator weaponized the Gitea diffpatch RCE CVE-2026-60004 (CVSS 9.8, Gitea 1.17-1.27.0, fixed in 1.27.1 on 2026-07-27) within days of the public PoC. The chain registers an account, creates a repository and submits the same crafted patch twice to the diffpatch endpoint, causing a payload to land in hooks/post-index-change that executes as the Gitea service account. The operator scanned 1,386 Gitea instances (477 in Taiwan), stole repositories and credentials, planted SSH authorized_keys, pivoted (including from a Synology NAS to a Proxmox cluster) and deployed JITTERLY, a C++ Linux implant matching the Adaptix C2 agent protocol, which embeds SIXZUT, a previously undocumented LD_PRELOAD rootkit (libglthread.so.2 via /etc/ld.so.preload). Confirmed compromises were in Canada, Argentina, Taiwan, the United States and Sri Lanka.

Other reported activity: an operator (BOSSAI investigation) connected more than 10 AI models to reconnaissance, scanning and exploitation tools, tasked via WeChat and LINE, with reusable instructions carrying procedures between campaigns and several tools running without approval prompts; reported targets were emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico. TamperedChef applications distributed via ads and search results perform their advertised function and carry valid EV code-signing certificates obtained through rotating U.S.-registered shell companies. Ransomware: a Qilin sample terminates processes and deletes Volume Shadow Copies; The Gentlemen maintain EDR-disabling tools for affiliates; LockBit 5.0 has Windows, Linux and ESXi variants (the ESXi variant shuts down running VMs); INC's encryptor deletes snapshots. Of more than 1.8 million endpoints running Acronis RMM, 63.1 percent had at least one additional remote management tool installed.

The source article states no CVSS for the overall report and lists no IOCs; IOCs below come from the underlying Acronis TRU technical posts. The BOSSAI operator is unattributed, and BOSSAI could not be independently corroborated beyond the Help Net Security summary. Severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1036.005 Masquerading: Match Legitimate Resource Name or Location

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1098.004 Account Manipulation: SSH Authorized Keys; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Collection

T1213 Data from Information Repositories

Impact

T1490 Inhibit System Recovery; T1496 Resource Hijacking

Credential Access

T1539 Steal Web Session Cookie

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools

Command and Control

T1573.001 Encrypted Channel: Symmetric Cryptography

stealth

T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

Remediation

Patches

• Gitea 1.27.1 (fixes CVE-2026-60004)

Immediate actions

• Upgrade Gitea to 1.27.1 or later, disable open registration, and restrict the diffpatch route where unused
• Audit installed OpenClaw skills and remove any from the publisher accounts listed in the Acronis report; rotate credentials and tokens exposed to affected agents
• Check /etc/ld.so.preload and authorized_keys on Gitea hosts; hunt for SIXZUT artifacts from a known-good kernel, offline image or EDR
• Block the network IOCs at the perimeter and review outbound connections from Gitea servers
• Rotate any credentials, tokens or SSH host keys stored in a compromised Gitea and rebuild confirmed hosts rather than cleaning them

Workarounds

• Disable open registration on Gitea
• Disable or restrict the diffpatch route if unused
• Alert on Gitea spawning shells, interpreters or curl

Longer-term hardening

• Require approval prompts and least-privilege permissions for AI agent tools and skills
• Vet third-party agent skills and Hugging Face artifacts before use; treat skill install instructions requesting driver or dependency downloads as suspicious
• Enforce phishing-resistant MFA and short-lived sessions to limit stolen-session reuse
• Inventory and remove unneeded secondary remote management tools
• Protect hypervisors, backups and snapshots against deletion and monitor for shadow copy deletion and EDR tampering

Affected and fixed versions

• OpenClaw — OpenClaw / ClawHub skills
  Vulnerable versions: Malicious skills from 13 developer accounts (575+ skills)
• Gitea — Gitea
  Vulnerable versions: 1.17 through 1.27.0
  Fixed in: 1.27.1
• Hugging Face — Hugging Face model/dataset repositories
  Vulnerable versions: Repositories hosting malicious payloads
• Microsoft — Windows
  Vulnerable versions: Windows endpoints running malicious OpenClaw skill payloads
• Apple — macOS
  Vulnerable versions: macOS endpoints running malicious OpenClaw skill payloads

Timeline

• 2026-04-30 Acronis TRU publishes 'Poisoning the well', documenting 575+ malicious OpenClaw skills from 13 developer accounts plus malicious payloads on Hugging Face
• 2026-07-27 Gitea 1.27.1 released, fixing the diffpatch RCE later tracked as CVE-2026-60004
• 2026-07-28 Full advisory and working public PoC for CVE-2026-60004 published, one day after the patch
• 2026-07-29 Red Heron operator clones the public GitHub PoC and begins modifying it
• 2026-07-30 Scan of 1,386 Gitea instances across seven countries completed (results stored in master_scanned.json)
• 2026-07-31 477-instance Taiwan target list compiled and hands-on exploitation of high-value targets begins
• 2026-08-04 Acronis discovers the JITTERLY implant during threat hunting, leading to an exposed staging server
• 2026-08-25 CISA adds CVE-2026-60004 to the Known Exploited Vulnerabilities catalog (per Hexnode)
• 2026-09-13 Acronis TRU publishes the Red Heron report exposing JITTERLY and the SIXZUT LD_PRELOAD rootkit
• 2026-10-27 Acronis updates the 'Poisoning the well' post (per page metadata)
• 2026-11-10 Help Net Security summarizes Acronis TRU Cyber Pulse 2026, covering BOSSAI, OpenClaw skills, Red Heron, TamperedChef and ransomware

Sources cited

• CISA Known Exploited Vulnerabilities catalog (CVE-2026-60004 added 2026-08-25 per Hexnode) CISA · Government advisory · 2026-08-25
• Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw (Acronis TRU) acronis.com · Research · 2026-04-30
• Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit (Acronis TRU) acronis.com · Research · 2026-09-13
• Red Heron Weaponizes Gitea RCE, Compromises 13 Organizations (Cloud Security Alliance research note) labs.cloudsecurityalliance.org · Research · 2026-09-16
• Over 575 malicious OpenClaw skills delivered malware to Windows and macOS (Help Net Security) Help Net Security · News · 2026-11-10

More in malware

• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft
• Kaspersky Q3 2026 Mobile Threat Statistics: Mamont/Creduz banker droppers, Triada/Vo1d preinstalled malware, AI-assisted Android fraud, DarkSword iOS exploit kit

Other reports on CVE-2026-60004

• September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation
• Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government Data
• Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
• Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)

Previous and next in malware

• RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal Browser and Wallet Credentials Previous report
• RevStealer (REF2859) Infostealer Spread via 100+ Domains, Hijacked YouTube Channels and Fake AI/Cheat Tools Next report

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks