Multi-Agent Attack Targeting Asian Governments: AI Automates the Offensive Chain

Eight AI Agents Coordinated Across 12 Waves

A campaign targeting government agencies in the Asia-Pacific region used a multi-agent architecture capable of automating much of the cyberattack lifecycle. Dream detailed the operation in research published on August 12.

The system could activate up to eight AI agents simultaneously, coordinated by a primary session. Each agent performed a distinct task, including reconnaissance, API analysis, exposed endpoint discovery, credential attacks, vulnerability exploitation, lateral movement, exfiltration, and backdoor installation.

The activity was divided into 12 attack waves. After each phase, the coordinating agent assessed the results using a Bayesian scoring algorithm: effective techniques received higher scores, while failed attempts were penalized. Subsequent waves therefore prioritized the strategies that had produced the most useful results.

This was not simply the automation of individual tools. The observed sequence replicated an offensive chain normally managed by multiple human analysts and operators, but with greater parallelization and adaptability.

OpenClaw and Hermes Underpin the Infrastructure

The attackers built the operational environment on the OpenClaw and Hermes agentic frameworks. The analyzed workspace exceeded 160 megabytes and contained 1,395 files.

The infrastructure was reportedly generated after unidentified frontier models were subjected to social engineering techniques. The operators allegedly induced the models to develop a penetration-testing framework intended to target an Asian government agency, bypassing the safeguards and restrictions built into the models.

The sub-agents were identified by individual letters from “A” to “Q.” Each was assigned a specific operational role. Observed activities included:

• probing public APIs and endpoints;
• identifying vulnerabilities;
• compromising or cracking government employee credentials;
• collecting additional credentials;
• accessing systems and networks;
• using secondary environments such as backup and test platforms;
• exfiltrating personnel data;
• installing persistent backdoors in web applications;
• validating results and optimizing subsequent stages.

The campaign reportedly did not require zero-day vulnerabilities. The operators combined social engineering, known flaws, credential theft, and abuse of misconfigured or ancillary environments. This challenges the assumption that AI-driven attacks depend on unknown vulnerabilities: AI can instead dramatically increase the effectiveness of techniques that are already available.

The Hypothesis of an Attack Against Taiwan

Dream did not formally attribute the operation to a specific group. The use of Simplified Chinese is consistent with Chinese-speaking operators, often associated with mainland China, but it does not prove that the attack was state-sponsored or originated from China.

Taiwan may have been the target. The hypothesis, initially reported by the Financial Times, was not publicly confirmed by Dream in order to protect its customers.

On August 13, Taiwan’s Ministry of Digital Affairs, or MODA, said it had detected anomalous attacks against government agencies in July. The investigation was conducted in cooperation with the National Institute of Cyber Security (NICS).

Taiwanese authorities issued internal alerts and began their investigation on July 20, completing it on August 13. According to MODA, the activity followed a hybrid model: human operators coordinated AI agents such as OpenClaw, which could rapidly chain together multiple techniques and use backup or testing systems as footholds for reaching other targets.

The campaign against the government target reportedly took place from July 1 to July 4. Dream detected the first signals on July 2 and continued its analysis over the following weeks. This timeline is consistent with the Taiwan hypothesis, but does not prove it.

The identity of the operators also remains uncertain. Dream, which monitors more than 100 threat groups, did not conclusively link the observed tactics to any group it already tracks.

Personnel Data and Persistent Backdoors

The potential impact concerns both information confidentiality and the ability to maintain long-term access. Theft of personnel data can facilitate subsequent targeted phishing, impersonation, and account-compromise campaigns.

Installing backdoors in government web applications, meanwhile, creates a persistence mechanism. Even after the initial access has been removed, attackers could attempt to regain entry through modified components or previously stolen credentials.

Abusing backup, development, and testing environments further expands the exposed attack surface. These systems are often less closely monitored than production environments, yet may contain configurations, secrets, database copies, or privileged connections to the main network.

According to Amir Becker, Dream’s chief business and strategy officer and a former commander of the cyber operations division of Israel’s Unit 8200, the speed, scale, and cost of offensive operations are changing rapidly. A defense based solely on manual processes may not be able to keep pace with systems capable of operating in parallel.

Carl Wright, chief commercial officer at AttackIQ and a former CISO of the U.S. Marine Corps, highlighted an additional risk: capabilities developed against regional targets could be refined and later deployed against organizations in other countries.

Taiwan and South Korea could become testing grounds for Chinese and North Korean actors, as well as criminal groups. Once the techniques have been refined, the same tools could be directed against organizations in the United Kingdom, the United States, or elsewhere.

Defensive Priorities

Organizations should begin with the attack surface actually exploited in the campaign: APIs, web applications, authentication systems, and secondary environments. The fact that zero-days were not required makes the management of known vulnerabilities and remediation of misconfigurations essential.

Operational priorities include:

• enforcing multifactor authentication for employee accounts;
• detecting anomalous credential-cracking attempts and credential reuse;
• separating backup, development, and testing environments from production;
• reviewing connections and privileges between secondary systems and core networks;
• monitoring web applications for persistent changes;
• searching for new backdoors, unexpected accounts, and unauthorized access keys;
• correlating events across accounts, APIs, endpoints, and different systems;
• testing AI models against manipulative requests framed as penetration-testing activities;
• using AI agents for authorized threat hunting, adversary simulation, and exposure assessment.

No CVE identifiers were reported in connection with the incident. The response therefore cannot be reduced to installing a single patch: it requires identity controls, segmentation, continuous monitoring, and automated validation of attack paths.

Above all, the case demonstrates an organizational shift. Attackers are combining human oversight with agents capable of researching, testing, evaluating, and repeating actions. Defenders will need to do the same while maintaining authorization, traceability, and strict limits on the systems being used.