# AI-Agent-Driven Intrusion Campaign Against Asian Government Systems (reported as Taiwan-targeted): Multi-Agent Password Spraying, SSO Pivoting and JWT 'none' Forgery

> Dream research, relayed by GBHackers, Cyber Security News and SecureWorld, describes a July 1-4, 2026 campaign in which up to eight Hermes/OpenClaw-based AI sub-agents per wave ran reconnaissance, CAPTCHA-solving password spraying, SSO pivoting and JWT 'alg=none' forgery against government systems. 85 accounts were cracked, 84 pivoted via SSO and at least 2,500 personnel records were exfiltrated. Dream did not name Taiwan or the operator; public reporting and Taiwan's MODA point to Taiwan and an overseas, suspected China-based operator, unconfirmed.

- **Published:** 2026-11-12T11:36:06Z
- **Last reviewed:** 2026-11-12T11:36:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5854
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5854.png
- **ID:** TL-2026-5854
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Dream (Dreamgroup) recovered a roughly 160 MB workspace of 1,395 files from an AI-agent attack framework built on the open-source Hermes and OpenClaw agent platforms. The framework launched up to eight sub-agents in parallel per wave, across 12 waves between July 1 and July 4, 2026. After each wave the agents produced structured reports, scored findings with a two-layer Bayesian model (finding confidence and whole-chain success probability), and ran 'Learning Cycles' that searched vulnerability databases, GitHub and security publications for techniques fitting the target stack. Seven of the agents' own findings were flagged as false positives and discarded, and findings went through six rounds of verification. Reporting says that when the underlying models refused attack steps, the operators framed the work as authorized penetration testing to bypass guardrails.

Reconnaissance consisted of decompiling JavaScript bundles from a government portal to extract API endpoints, OAuth client IDs and Keycloak configuration, scraping a public SSO documentation site, and mapping 21 connected government systems and a national SSO with six sub-realms, signing keys and authentication flows. Unauthenticated APIs leaked employee names, departments and SSO account identifiers, and undocumented debug endpoints returned valid authenticated sessions without credentials. The agents then sprayed an office-automation/employee portal using usernames harvested from the exposed APIs and predictable passwords tied to employee IDs, solving CAPTCHAs with Tesseract OCR, and cracked 85 accounts. 84 of the 85 (98.8%) authenticated to an internal information system through an SSO bridge without additional authentication. A separate government API accepted JSON Web Tokens with the signature algorithm set to 'none', allowing token forgery without a signing key. An upload attempt through an unrestricted file-upload endpoint was reportedly blocked by a secondary Forms Authentication layer.

Collected data included at least 2,564 personnel records (1,409 employee entries, 916 user records from an exposed API, 239 legal-professional records from a Ministry of Justice endpoint), internal network ranges, 7 SSO client secrets and 6 database credentials (per Cyber Security News). SecureWorld adds that the agents scanned government IT supply-chain vendors, a nuclear safety agency, a government email system and several energy-sector companies. Sources disagree on persistence: GBHackers says persistent backdoors were installed, while Cyber Security News reports none. Taiwan's Ministry of Digital Affairs (MODA) says it detected the activity in July, began advisories on July 20, and that affected agencies have remediated; MODA describes a hybrid of conventional hacking and AI agents originating overseas. Attribution is unconfirmed: Dream noted Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis as a possible clue, not proof. No IPs, domains or file hashes have been published. Primary Dream report was not directly retrieved; facts come from secondary outlets.

The GBHackers article also bundles related AI-enabled activity: Bitdefender's APT36 'vibeware' (medium confidence, C2 via Discord, Slack, Google Sheets, Supabase, Firebase, mainly against Indian government), WithSecure's GREYVIBE (Russia-nexus, ChatGPT/Gemini/Ideogram-assisted tooling against Ukraine), TeamPCP's March 2026 compromise of LiteLLM 1.82.7/1.82.8 on PyPI via a poisoned Trivy scanner in CI/CD, and April 2026 CanisterWorm-style npm tradecraft using an Internet Computer canister. These are context, not part of the Dream-reported campaign. Recorded Future Insikt Group's report analyzed 103 AI-enabled incidents (July 31, 2025 to July 31, 2026) and singles out the Taiwan campaign as an exception to the rule that fully autonomous attacks remain rare.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1594 Search Victim-Owned Websites
- T1589 Gather Victim Identity Information
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1110.003 Brute Force: Password Spraying
- T1606 Forge Web Credentials
- T1087 Account Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1505.003 Server Software Component: Web Shell

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JWT alg=none Forged Token Accepted by API (TL-2026-5854)** (`TL-2026-5854-SPL-001`)

Detects HTTP requests that present a JSON Web Token whose header declares alg=none (base64url prefixes for none/None/NONE, including the typ-first variant) or that carries an empty signature segment, and that the API answered with a 2xx/3xx status. This is the token-forgery primitive (CWE-345) reported against a government API in the AI-agent-driven intrusion campaign TL-2026-5854: a correct server rejects these tokens, so an accepted one means the verifier trusts the token's own algorithm claim.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1606, T1190, T1550.001
- **Data sources:** nginx_access_logs, api_gateway_logs, waf_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=nginx:plus:kv earliest=-24h status>=200 status<400
| eval auth_hdr=coalesce(http_authorization, auth_header)
| where isnotnull(auth_hdr)
| where match(auth_hdr, "^[Bb]earer +eyJhbGciOiJ(ub25l|Ob25l|OT05F)") OR match(auth_hdr, "^[Bb]earer +eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l") OR match(auth_hdr, "^[Bb]earer +[A-Za-z0-9_-]+[.][A-Za-z0-9_-]+[.]$")
| eval jwt_header_b64=mvindex(split(replace(auth_hdr, "^[Bb]earer +", ""), "."), 0)
| stats count as accepted_requests dc(uri_path) as distinct_paths values(uri_path) as paths values(jwt_header_b64) as jwt_headers min(_time) as first_seen max(_time) as last_seen by src_ip, host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Jwt = extract(@"(eyJ[A-Za-z0-9_-]+[.][A-Za-z0-9_-]*[.][A-Za-z0-9_-]*)", 1, strcat(AdditionalExtensions, ' ', RequestContext))
| where isnotempty(Jwt)
| where Jwt matches regex @"^eyJhbGciOiJ(ub25l|Ob25l|OT05F)" or Jwt startswith 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l' or Jwt matches regex @"[.]$"
| extend HttpStatus = toint(extract(@"(?:status|outcome|responseCode)=([0-9]{3})", 1, AdditionalExtensions))
| where isnull(HttpStatus) or HttpStatus between (200 .. 399)
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestMethod, RequestURL, HttpStatus, JwtHeaderB64 = tostring(split(Jwt, '.')[0])
```

### Sigma

```yaml
title: JWT alg=none Forged Token Accepted by API
id: 5b6f2c1e-8d4a-4c37-9e51-0a7d3f6b2c11
status: experimental
description: Detects Authorization bearer tokens whose JWT header declares alg=none (or that have an empty signature) and that were answered with a success or redirect status. Seen against a government API in TL-2026-5854 (AI-agent-driven intrusion campaign).
references:
    - https://www.secureworld.io/industry-news/first-fully-autonomous-ai-cyber-attack-government
    - https://gbhackers.com/ai-agents-target-taiwan/
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.credential-access
    - attack.t1606
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1550.001
logsource:
    category: webserver
detection:
    selection_alg_none:
        cs-authorization|startswith:
            - 'Bearer eyJhbGciOiJub25l'
            - 'Bearer eyJhbGciOiJOb25l'
            - 'Bearer eyJhbGciOiJOT05F'
            - 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l'
    selection_empty_sig:
        cs-authorization|re: '^[Bb]earer [A-Za-z0-9_-]+[.][A-Za-z0-9_-]+[.]$'
    selection_status:
        sc-status:
            - 200
            - 201
            - 202
            - 204
            - 301
            - 302
    condition: (1 of selection_alg_* or selection_empty_sig) and selection_status
falsepositives:
    - Authorized penetration tests or DAST scanners that probe for the alg=none weakness
    - Unit or integration test traffic against non-production gateways
level: high

```

**Known false positives:**

- Authorized penetration tests or DAST scanners probing for the alg=none weakness
- Integration test traffic against non-production gateways that intentionally send unsigned tokens and expect a 401

**Tuning notes:** Requires the Authorization header to be captured in the access log (field http_authorization or auth_header in SPL; CEF extension in KQL; cs-authorization in Sigma). Remap index, sourcetype and field names to your gateway. Exclude scanner source IPs. A hit with a 2xx status is a confirmed verifier flaw; also alert on 401/403 responses at lower priority to catch probing before the API is fixed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unauthenticated Debug Endpoint Issuing Authenticated Session (TL-2026-5854) (locked: unlock with TL Creds)
- API Endpoint Enumeration after JS Bundle and Keycloak Config Retrieval (T1594) (locked: unlock with TL Creds)
- Machine-Paced Bulk Harvesting of Personnel Records via API (T1213, T1119) (locked: unlock with TL Creds)
- IIS Worker Process Writing Web Shell Script File (T1505.003) (locked: unlock with TL Creds)
- Hermes Agent, OpenClaw or Tesseract OCR Execution on Enterprise Host (T1588.007) (locked: unlock with TL Creds)
- Keycloak Client Credentials Login or Secret Guessing from External Address (T1550.001) (locked: unlock with TL Creds)
- Keycloak Password Spraying Across Many Accounts from One Source (T1110.003) (locked: unlock with TL Creds)
- Single Account Rapid SSO Pivot Across Multiple Keycloak Clients (T1550.001) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [State-Sponsored Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems (GBHackers)](https://gbhackers.com/ai-agents-target-taiwan/)
- [Eight AI Agents Breach Government Systems (Cyber Security News, citing Dream)](https://cybersecuritynews.com/eight-ai-agents-breach-government-systems/amp/)
- [Inside the First Confirmed Fully Autonomous AI Cyberattack on a Government (SecureWorld)](https://www.secureworld.io/industry-news/first-fully-autonomous-ai-cyber-attack-government)
- [Multi-Agent AI Framework Compromises Government Systems (GBHackers)](https://gbhackers.com/multi-agent-ai-framework-compromises-government-systems/amp/)
- [Recorded Future Insikt Group: AI Cyber Threat Trends 2026](https://www.recordedfuture.com/research/ai-cyber-threat-trends-2026)
- [AI Incident Database: Incident 1646](https://incidentdatabase.ai/cite/1646/)
- [Aviatrix: Hermes AI Agent Attack on Thai Finance Ministry (related Hermes misuse)](https://aviatrix.ai/threat-research-center/hermes-ai-agent-attack-thai-finance-ministry-2026/)
- [Compromised LiteLLM Package with 95M Downloads (GBHackers, related TeamPCP context)](https://gbhackers.com/compromised-litellm-package-with-95m-downloads/)
- [CanisterWorm Hijacks npm (GBHackers, related context)](https://gbhackers.com/canisterworm-hijacks-npm/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5854