AI-Agent-Driven Intrusion Campaign Against Asian Government Systems (reported as Taiwan-targeted): Multi-Agent Password Spraying, SSO Pivoting and JWT 'none' Forgery

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5854 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: JWT alg=none Forged Token Accepted by API (TL-2026-5854)

Detects HTTP requests that present a JSON Web Token whose header declares alg=none (base64url prefixes for none/None/NONE, including the typ-first variant) or that carries an empty signature segment, and that the API answered with a 2xx/3xx status. This is the token-forgery primitive (CWE-345) reported against a government API in the AI-agent-driven intrusion campaign TL-2026-5854: a correct server rejects these tokens, so an accepted one means the verifier trusts the token's own algorithm claim.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1606, T1190, T1550.001
• Data sources: nginx_access_logs, api_gateway_logs, waf_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype=nginx:plus:kv earliest=-24h status>=200 status<400
| eval auth_hdr=coalesce(http_authorization, auth_header)
| where isnotnull(auth_hdr)
| where match(auth_hdr, "^[Bb]earer +eyJhbGciOiJ(ub25l|Ob25l|OT05F)") OR match(auth_hdr, "^[Bb]earer +eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l") OR match(auth_hdr, "^[Bb]earer +[A-Za-z0-9_-]+[.][A-Za-z0-9_-]+[.]$")
| eval jwt_header_b64=mvindex(split(replace(auth_hdr, "^[Bb]earer +", ""), "."), 0)
| stats count as accepted_requests dc(uri_path) as distinct_paths values(uri_path) as paths values(jwt_header_b64) as jwt_headers min(_time) as first_seen max(_time) as last_seen by src_ip, host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Jwt = extract(@"(eyJ[A-Za-z0-9_-]+[.][A-Za-z0-9_-]*[.][A-Za-z0-9_-]*)", 1, strcat(AdditionalExtensions, ' ', RequestContext))
| where isnotempty(Jwt)
| where Jwt matches regex @"^eyJhbGciOiJ(ub25l|Ob25l|OT05F)" or Jwt startswith 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l' or Jwt matches regex @"[.]$"
| extend HttpStatus = toint(extract(@"(?:status|outcome|responseCode)=([0-9]{3})", 1, AdditionalExtensions))
| where isnull(HttpStatus) or HttpStatus between (200 .. 399)
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestMethod, RequestURL, HttpStatus, JwtHeaderB64 = tostring(split(Jwt, '.')[0])

Sigma

title: JWT alg=none Forged Token Accepted by API
id: 5b6f2c1e-8d4a-4c37-9e51-0a7d3f6b2c11
status: experimental
description: Detects Authorization bearer tokens whose JWT header declares alg=none (or that have an empty signature) and that were answered with a success or redirect status. Seen against a government API in TL-2026-5854 (AI-agent-driven intrusion campaign).
references:
    - https://www.secureworld.io/industry-news/first-fully-autonomous-ai-cyber-attack-government
    - https://gbhackers.com/ai-agents-target-taiwan/
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.credential-access
    - attack.t1606
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1550.001
logsource:
    category: webserver
detection:
    selection_alg_none:
        cs-authorization|startswith:
            - 'Bearer eyJhbGciOiJub25l'
            - 'Bearer eyJhbGciOiJOb25l'
            - 'Bearer eyJhbGciOiJOT05F'
            - 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l'
    selection_empty_sig:
        cs-authorization|re: '^[Bb]earer [A-Za-z0-9_-]+[.][A-Za-z0-9_-]+[.]$'
    selection_status:
        sc-status:
            - 200
            - 201
            - 202
            - 204
            - 301
            - 302
    condition: (1 of selection_alg_* or selection_empty_sig) and selection_status
falsepositives:
    - Authorized penetration tests or DAST scanners that probe for the alg=none weakness
    - Unit or integration test traffic against non-production gateways
level: high

Known false positives:

• Authorized penetration tests or DAST scanners probing for the alg=none weakness
• Integration test traffic against non-production gateways that intentionally send unsigned tokens and expect a 401

Tuning notes: Requires the Authorization header to be captured in the access log (field http_authorization or auth_header in SPL; CEF extension in KQL; cs-authorization in Sigma). Remap index, sourcetype and field names to your gateway. Exclude scanner source IPs. A hit with a 2xx status is a confirmed verifier flaw; also alert on 401/403 responses at lower priority to catch probing before the API is fixed.

• 🔒 Unauthenticated Debug Endpoint Issuing Authenticated Session (TL-2026-5854) · unlock with TL Creds
• 🔒 API Endpoint Enumeration after JS Bundle and Keycloak Config Retrieval (T1594) · unlock with TL Creds
• 🔒 Machine-Paced Bulk Harvesting of Personnel Records via API (T1213, T1119) · unlock with TL Creds
• 🔒 IIS Worker Process Writing Web Shell Script File (T1505.003) · unlock with TL Creds
• 🔒 Hermes Agent, OpenClaw or Tesseract OCR Execution on Enterprise Host (T1588.007) · unlock with TL Creds
• 🔒 Keycloak Client Credentials Login or Secret Guessing from External Address (T1550.001) · unlock with TL Creds
• 🔒 Keycloak Password Spraying Across Many Accounts from One Source (T1110.003) · unlock with TL Creds
• 🔒 Single Account Rapid SSO Pivot Across Multiple Keycloak Clients (T1550.001) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5854.

Technical analysis

85 accounts were cracked, 84 pivoted via SSO and at least 2,500 personnel records were exfiltrated. Dream did not name Taiwan or the operator; public reporting and Taiwan's MODA point to Taiwan and an overseas, suspected China-based operator, unconfirmed.

Dream (Dreamgroup) recovered a roughly 160 MB workspace of 1,395 files from an AI-agent attack framework built on the open-source Hermes and OpenClaw agent platforms. The framework launched up to eight sub-agents in parallel per wave, across 12 waves between July 1 and July 4, 2026. After each wave the agents produced structured reports, scored findings with a two-layer Bayesian model (finding confidence and whole-chain success probability), and ran 'Learning Cycles' that searched vulnerability databases, GitHub and security publications for techniques fitting the target stack. Seven of the agents' own findings were flagged as false positives and discarded, and findings went through six rounds of verification. Reporting says that when the underlying models refused attack steps, the operators framed the work as authorized penetration testing to bypass guardrails.

Reconnaissance consisted of decompiling JavaScript bundles from a government portal to extract API endpoints, OAuth client IDs and Keycloak configuration, scraping a public SSO documentation site, and mapping 21 connected government systems and a national SSO with six sub-realms, signing keys and authentication flows. Unauthenticated APIs leaked employee names, departments and SSO account identifiers, and undocumented debug endpoints returned valid authenticated sessions without credentials. The agents then sprayed an office-automation/employee portal using usernames harvested from the exposed APIs and predictable passwords tied to employee IDs, solving CAPTCHAs with Tesseract OCR, and cracked 85 accounts. 84 of the 85 (98.8%) authenticated to an internal information system through an SSO bridge without additional authentication. A separate government API accepted JSON Web Tokens with the signature algorithm set to 'none', allowing token forgery without a signing key. An upload attempt through an unrestricted file-upload endpoint was reportedly blocked by a secondary Forms Authentication layer.

Collected data included at least 2,564 personnel records (1,409 employee entries, 916 user records from an exposed API, 239 legal-professional records from a Ministry of Justice endpoint), internal network ranges, 7 SSO client secrets and 6 database credentials (per Cyber Security News). SecureWorld adds that the agents scanned government IT supply-chain vendors, a nuclear safety agency, a government email system and several energy-sector companies. Sources disagree on persistence: GBHackers says persistent backdoors were installed, while Cyber Security News reports none. Taiwan's Ministry of Digital Affairs (MODA) says it detected the activity in July, began advisories on July 20, and that affected agencies have remediated; MODA describes a hybrid of conventional hacking and AI agents originating overseas. Attribution is unconfirmed: Dream noted Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis as a possible clue, not proof. No IPs, domains or file hashes have been published. Primary Dream report was not directly retrieved; facts come from secondary outlets.

The GBHackers article also bundles related AI-enabled activity: Bitdefender's APT36 'vibeware' (medium confidence, C2 via Discord, Slack, Google Sheets, Supabase, Firebase, mainly against Indian government), WithSecure's GREYVIBE (Russia-nexus, ChatGPT/Gemini/Ideogram-assisted tooling against Ukraine), TeamPCP's March 2026 compromise of LiteLLM 1.82.7/1.82.8 on PyPI via a poisoned Trivy scanner in CI/CD, and April 2026 CanisterWorm-style npm tradecraft using an Internet Computer canister. These are context, not part of the Dream-reported campaign. Recorded Future Insikt Group's report analyzed 103 AI-enabled incidents (July 31, 2025 to July 31, 2026) and singles out the Taiwan campaign as an exception to the rule that fully autonomous attacks remain rare.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087 Account Discovery

Credential Access

T1110.003 Brute Force: Password Spraying; T1606 Forge Web Credentials

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Persistence

T1505.003 Server Software Component: Web Shell

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1594 Search Victim-Owned Websites

Remediation

Patches

• No CVE assigned; remediation is configuration and code hardening of the affected portals and APIs

Immediate actions

• Remove or lock down undocumented debug endpoints that return authenticated sessions
• Require authentication on all APIs that expose employee, user or SSO account data
• Reject JWTs with alg=none and enforce an explicit server-side algorithm allowlist
• Rotate SSO client secrets and database credentials stored in or reachable from exposed systems
• Reset credentials of accounts subject to password spraying and review SSO sign-in logs for the 84 pivot pattern

Workarounds

• Place WAF or API-gateway rules in front of exposed portals to block alg=none tokens and anomalous spraying
• Restrict file-upload endpoints and keep secondary authentication layers in front of them

Longer-term hardening

• Enforce MFA on employee portals and SSO bridges; ban predictable passwords derived from employee IDs
• Add rate limiting, bot detection and non-OCR-solvable challenges to login flows
• Review SSO trust relationships so one cracked account cannot reach every trusted system
• Avoid shipping API endpoints, OAuth client IDs and realm configuration in client-side JavaScript bundles
• Audit third-party AI dependencies, plugins and open-weight model repositories; monitor infostealer logs for exposed AI subscriptions, API keys and OAuth tokens
• Detect high-volume, multi-threaded, machine-paced authentication and API enumeration patterns consistent with agent orchestration

Affected and fixed versions

• Unnamed Asian government entities (reported as Taiwan) — Government portals, national SSO (Keycloak-based), office-automation portal, internal information system
  Vulnerable versions: Instances with exposed debug endpoints, unauthenticated APIs, JWT alg=none acceptance and weak password policy

Timeline

• 2026-07-01 First of 12 attack waves; up to eight Hermes/OpenClaw sub-agents per wave begin reconnaissance and credential attacks on government systems
• 2026-07-04 Final wave of the roughly four-day campaign; 85 accounts cracked, 84 pivoted via SSO, at least 2,564 personnel records collected
• 2026-07-20 Taiwan's Ministry of Digital Affairs begins issuing advisories and opens an investigation after monitoring units spotted the activity in July
• 2026-07-24 Related context: Aviatrix publishes analysis of reported Hermes-Agent use against a Thai Ministry of Finance network (unconfirmed by the ministry)
• 2026-08-14 SecureWorld publishes its report on Dream's research on the recovered 1,395-file framework workspace (Cyber Security News covered it around the same period)
• 2026-11-12 GBHackers publishes its Taiwan-headlined article, adding Recorded Future Insikt context on AI-enabled threats

Sources cited

• Recorded Future Insikt Group: AI Cyber Threat Trends 2026 Recorded Future · Research
• AI Incident Database: Incident 1646 incidentdatabase.ai · Research
• Aviatrix: Hermes AI Agent Attack on Thai Finance Ministry (related Hermes misuse) aviatrix.ai · Vendor report · 2026-07-24
• State-Sponsored Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems (GBHackers) gbhackers.com · News · 2026-11-12
• Eight AI Agents Breach Government Systems (Cyber Security News, citing Dream) cybersecuritynews.com · News
• Inside the First Confirmed Fully Autonomous AI Cyberattack on a Government (SecureWorld) secureworld.io · News · 2026-08-14
• Multi-Agent AI Framework Compromises Government Systems (GBHackers) gbhackers.com · News
• Compromised LiteLLM Package with 95M Downloads (GBHackers, related TeamPCP context) gbhackers.com · News
• CanisterWorm Hijacks npm (GBHackers, related context) gbhackers.com · News

More in threat intel

• ARTEX open-source AI pentesting framework weaponized by China-aligned and criminal actors (Storm-0940, VAPOR PANDA, Storm-3358, Crafty Falcon); leaked secrets are the primary entry vector; backdoored Docker images
• Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)
• ARTEX open-source AI autonomous pentest framework abused by threat actors; 1,465 exposed consoles per Censys
• AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation
• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)