Threat video1:00
Hermes/OpenClaw AI Agent Intrusion: Detection & IOCs
Up to eight Hermes/OpenClaw AI sub-agents per wave cracked 85 accounts and pivoted through SSO; 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Hermes/OpenClaw AI Agent Intrusion: Detection & IOCs →
Chapters
- 0:00The hookReportedly, AI agents cracked 85 accounts.
- 0:04The storyAI agents hit government systems.
- 0:11Attack pathAI agents, reportedly, harvested employee names.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise3 indicators to hunt: 1 file name and 2 package names.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from reconnaissance to collection.
- 0:43Remediation5 steps now: Remove or lock down undocumented debug endpoints that return authenticated.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Reportedly, AI agents cracked 85 accounts.
0:05AI agents hit government systems.
0:07Then 84 of 85 pivoted via SSO.
0:12AI agents, reportedly, harvested employee names.
0:15They sprayed a portal, solving CAPTCHAs.
0:18A token-signing flaw let them forge tokens.
0:21Agents then pulled at least 2,564 personnel records.
0:29No threat actor is attributed. Confidence: low.
0:333 indicators to hunt: 1 file name and 2 package names.
0:3813 ATT&CK techniques, from reconnaissance to collection.
0:435 steps now: Remove or lock down undocumented debug endpoints that return authenticated.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.