# AI-agent-coordinated attacks and 575+ malicious OpenClaw skills delivering malware (Acronis TRU Cyber Pulse 2026)

> Acronis TRU reporting, summarized by Help Net Security on 2026-11-10, describes more than 575 malicious OpenClaw (ClawHub) skills delivering trojans, cryptominers and the AMOS infostealer to Windows and macOS, malicious payloads disguised as models and datasets on Hugging Face, and the Red Heron campaign exploiting Gitea CVE-2026-60004. The report also covers an operator coordinating attacks with AI agents (BOSSAI), TamperedChef signed applications, and ransomware (Qilin, The Gentlemen, LockBit 5.0, INC) that disables defenses and recovery.

- **Published:** 2026-11-10T05:57:18Z
- **Last reviewed:** 2026-11-10T05:57:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5615
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5615.png
- **ID:** TL-2026-5615
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 35 (3 shown free below)
- **CVEs:** CVE-2026-60004

## Description

Acronis Threat Research Unit's 2026 Cyber Pulse reporting, as summarized by Help Net Security, describes cybercriminals using AI agents to coordinate attacks, stolen credentials and sessions to reach linked services, and tooling that interferes with detection and recovery.

AI supply chain: Acronis identified more than 575 malicious OpenClaw skills on ClawHub published by 13 developer accounts; two accounts (hightower6eu with 334 skills and sakaen736jih with 199) account for about 93 percent. Skills pose as utilities (for example a YouTube transcript summarizer that requires an 'OpenClawDriver' to be installed first). Windows victims are told to download a password-protected archive from GitHub or MediaFire (ClawHub-DependencyInstaller.zip with a 'README BEFORE INSTALLING.txt'); macOS victims are told to run a base64-encoded command piped to bash that fetches the AMOS stealer from 91.92.242.30 and strips quarantine with xattr -c. The Windows loader is packed with VMProtect, decrypts strings with a 30-byte XOR key, resolves APIs dynamically, runs payloads in memory via NT APIs, injects into explorer.exe with a watchdog, persists via hidden %APPDATA% directories, scheduled tasks, a Run key and Windows Defender exclusions, and delivers a cryptominer masquerading as svchost.exe from velvet-parrot.com. A Telegram bot (t.me/dusty_vintage) acts as a dead-drop resolver. Skills can also pair instructions with executable code that uses permissions the agent already holds, and Acronis documents indirect prompt injection as a technique. Acronis also documented malicious payloads disguised as models, datasets and AI applications on Hugging Face (ITHKRPAW campaign against Vietnamese/financial targets via LNK and Cloudflare Workers PowerShell dropper; FAKESECURITY fake Windows Defender).

Red Heron: Acronis assesses with moderate confidence that a Chinese-speaking operator weaponized the Gitea diffpatch RCE CVE-2026-60004 (CVSS 9.8, Gitea 1.17-1.27.0, fixed in 1.27.1 on 2026-07-27) within days of the public PoC. The chain registers an account, creates a repository and submits the same crafted patch twice to the diffpatch endpoint, causing a payload to land in hooks/post-index-change that executes as the Gitea service account. The operator scanned 1,386 Gitea instances (477 in Taiwan), stole repositories and credentials, planted SSH authorized_keys, pivoted (including from a Synology NAS to a Proxmox cluster) and deployed JITTERLY, a C++ Linux implant matching the Adaptix C2 agent protocol, which embeds SIXZUT, a previously undocumented LD_PRELOAD rootkit (libglthread.so.2 via /etc/ld.so.preload). Confirmed compromises were in Canada, Argentina, Taiwan, the United States and Sri Lanka.

Other reported activity: an operator (BOSSAI investigation) connected more than 10 AI models to reconnaissance, scanning and exploitation tools, tasked via WeChat and LINE, with reusable instructions carrying procedures between campaigns and several tools running without approval prompts; reported targets were emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico. TamperedChef applications distributed via ads and search results perform their advertised function and carry valid EV code-signing certificates obtained through rotating U.S.-registered shell companies. Ransomware: a Qilin sample terminates processes and deletes Volume Shadow Copies; The Gentlemen maintain EDR-disabling tools for affiliates; LockBit 5.0 has Windows, Linux and ESXi variants (the ESXi variant shuts down running VMs); INC's encryptor deletes snapshots. Of more than 1.8 million endpoints running Acronis RMM, 63.1 percent had at least one additional remote management tool installed.

The source article states no CVSS for the overall report and lists no IOCs; IOCs below come from the underlying Acronis TRU technical posts. The BOSSAI operator is unattributed, and BOSSAI could not be independently corroborated beyond the Help Net Security summary. Severity is analyst-assigned.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1204.002 User Execution: Malicious File
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1014 Rootkit
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1553.002 Subvert Trust Controls: Code Signing
- T1539 Steal Web Session Cookie
- T1213 Data from Information Repositories
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1490 Inhibit System Recovery
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gitea diffpatch RCE (CVE-2026-60004) - Gitea Service Spawning Shell, Downloader or post-index-change Hook (Red Heron)** (`TL-2026-5615-SPL-001`)

Detects exploitation of the Gitea diffpatch RCE CVE-2026-60004 as used by Red Heron (TL-2026-5615). The crafted patch lands a payload in hooks/post-index-change, which executes as the Gitea service account. The rule fires when the gitea process (or a post-index-change hook, which is not a standard Git hook) spawns a shell, interpreter or downloader, the post-exploitation behaviour that precedes SSH key planting and JITTERLY deployment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** sysmon_for_linux, microsoft_defender_endpoint_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h (ParentImage="*/gitea" OR ParentImage="*/gitea-web" OR ParentCommandLine="*/hooks/post-index-change*" OR CommandLine="*/hooks/post-index-change*") (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/python3" OR Image="*/perl")
| fillnull value="unknown" ParentImage Image CommandLine ParentCommandLine User
| eval cve="CVE-2026-60004", campaign="Red Heron"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmds values(User) as users by host ParentImage Image cve campaign
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('gitea', 'gitea-web') or InitiatingProcessCommandLine has '/hooks/post-index-change' or ProcessCommandLine has '/hooks/post-index-change'
| where FileName in~ ('sh', 'bash', 'dash', 'curl', 'wget', 'nc', 'ncat', 'python3', 'perl')
| extend CVE = 'CVE-2026-60004', Campaign = 'Red Heron'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, CVE, Campaign
| order by Timestamp desc
```

### Sigma

```yaml
title: Gitea Service Spawning Shell or Downloader - CVE-2026-60004 diffpatch RCE
id: 7c1d3f52-9b0e-4a6d-8f21-3e5a1c7b9d01
status: experimental
description: Detects the Gitea service spawning shells, interpreters or downloaders, or execution of a post-index-change repository hook, consistent with exploitation of the Gitea diffpatch RCE CVE-2026-60004 by Red Heron.
references:
    - https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/
    - https://labs.cloudsecurityalliance.org/research/csa-research-note-red-heron-gitea-rce-campaign-20260916-csa/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026-60004
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/gitea'
            - '/gitea-web'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/python3'
            - '/perl'
    selection_hook:
        CommandLine|contains: '/hooks/post-index-change'
    condition: (selection_parent and selection_child) or selection_hook
falsepositives:
    - Custom Gitea webhooks or server-side hooks that intentionally invoke shell scripts
    - Gitea administrators running maintenance scripts under the service account
level: high
```

**Known false positives:**

- Legitimate server-side Git hooks or Gitea webhook scripts that call sh/bash/curl
- Administrators running maintenance scripts as the gitea service account

**Tuning notes:** Baseline legitimate hook scripts per repository and allowlist their exact CommandLine paths. Treat any execution of hooks/post-index-change as high fidelity because it is not a standard Git hook. Adjust the Gitea binary name or path if the service runs under a custom name, and correlate with POST requests to /_diffpatch/ in reverse-proxy logs. Patch to Gitea 1.27.1 and disable open registration.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious OpenClaw Skill Lure - ClawHub-DependencyInstaller and OpenClaw GitHub Release Archives (Windows) (locked: unlock with TL Creds)
- OpenClaw Windows Loader Persistence - AppData Scheduled Task, Run Key, Defender Exclusion and svchost.exe Masquerade (locked: unlock with TL Creds)
- OpenClaw Malware Infrastructure - [indicator] Miner C2, AMOS [indicator], Telegram Dead-Drop and Community Sibling Domains (locked: unlock with TL Creds)
- macOS AMOS Stealer Delivery - Base64 Piped to Shell, xattr Quarantine Strip and [indicator] (locked: unlock with TL Creds)
- Red Heron Linux Persistence - Planted SSH authorized_keys and Fake systemd-network-helper Service (locked: unlock with TL Creds)
- Ransomware Recovery Inhibition - Shadow Copy Deletion, Backup Catalog Removal and bcdedit Recovery Tampering (Qilin, INC, LockBit 5.0) (locked: unlock with TL Creds)
- SIXZUT LD_PRELOAD Rootkit - /etc/ld.so.preload, [indicator] and JITTERLY Artifacts (locked: unlock with TL Creds)
- JITTERLY / Adaptix C2 Infrastructure - [indicator]:8082, Staging [indicator]:8888 and Beacon Regularity (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 35)

Defanged, TLP:CLEAR.

- IP address: `91.92.242[.]30`
- Domain: `velvet-parrot[.]com`
- URL: `hxxps://t[.]me/dusty_vintage`

Full set of 35 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Over 575 malicious OpenClaw skills delivered malware to Windows and macOS (Help Net Security)](https://www.helpnetsecurity.com/2026/11/10/acronis-ai-agent-cyberattacks-report/)
- [Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw (Acronis TRU)](https://www.acronis.com/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw/)
- [Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit (Acronis TRU)](https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/)
- [Red Heron Weaponizes Gitea RCE, Compromises 13 Organizations (Cloud Security Alliance research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-red-heron-gitea-rce-campaign-20260916-csa/)
- [CISA Known Exploited Vulnerabilities catalog (CVE-2026-60004 added 2026-08-25 per Hexnode)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5615