Threat video1:00
OpenClaw Malicious Skills Drop AMOS: Detection & IOCs
Over 575 OpenClaw skills push AMOS and miners to Windows and macOS. Covers 9 detection rules, 35 IOCs and 18 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for OpenClaw Malicious Skills Drop AMOS: Detection & IOCs →
Chapters
- 0:00The hook575+ malicious OpenClaw skills.
- 0:04The storyDay after the patch, a public exploit.
- 0:10Attack pathOperators scanned 1,386 Gitea instances.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise29 indicators to hunt: 2 IPs, 4 domains and 8 URLs, and more.
- 0:40MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:44Remediation14 remediation steps are listed, 5 of them immediate.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00575+ malicious OpenClaw skills.
0:05Day after the patch, a public exploit.
0:07Confirmed breaches spanned five countries.
0:10Operators scanned 1,386 Gitea instances.
0:15They exploited a remote-code-execution flaw.
0:18They stole repositories and credentials.
0:21They planted SSH keys and pivoted onward.
0:24JITTERLY implant deployed, plus an undocumented rootkit.
0:29No threat actor is attributed. Confidence: low.
0:3429 indicators to hunt: 2 IPs, 4 domains and 8 URLs, and more.
0:4018 ATT&CK techniques, from initial access to impact.
0:4414 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.