EN PT-BR
← Voltar ao feed
high government emergency_services education

Acronis report: AI agents, malicious OpenClaw skills and ransomware tooling drive intrusions

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 02:30 · coletado há 1 hora

The Acronis TRU Cyber Pulse 2026 report describes cybercriminals using AI agents to coordinate attacks, reusing stolen credentials and browser sessions to reach linked cloud services, and deploying tools that interfere with intrusion detection and system recovery. In the BOSSAI investigation, one operator connected more than 10 AI models to reconnaissance, scanning and exploitation tools through WeChat and LINE, with reported activity against emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico. The report also counts more than 575 malicious OpenClaw skills that delivered trojans, cryptocurrency miners and information stealers to Windows and macOS. Ransomware families including Qilin, The Gentlemen, LockBit 5.0 and INC target security tooling, shadow copies, snapshots and virtual machines. No vendor advisory or CVE is named in the article, and external research could not be completed for this record, so the facts below rest on the article alone.

Detalhes técnicos

  • BOSSAI: reusable instructions carried procedures and target details from one campaign to the next, and several tools ran without approval prompts, so agents could pick and run them within their granted permissions.
  • OpenClaw skills: agent skills can pair instructions with executable code that uses permissions the agent already holds. On Hugging Face, malicious payloads were disguised as models, datasets and AI applications.
  • Session and credential abuse: a stolen browser session can reach connected cloud applications without a new MFA challenge, while repository credentials and API keys can expose source code and services tied to a developer account. Access can also be handed from one actor to another, including to ransomware operators or espionage groups.
  • Remote management: of more than 1.8 million endpoints running the vendor's own remote monitoring and management software, 63.1% had at least one additional remote management or remote access tool installed, some left over after a provider change.
  • Red Heron: a working public exploit appeared the day after Gitea issued a patch for a critical vulnerability. Attackers adapted it against internet-facing Gitea servers and, in confirmed breaches, stole repositories, collected credentials and moved to other systems.
  • Ransomware: a Qilin sample could terminate processes and delete Windows Volume Shadow Copies before encryption. The Gentlemen maintained tools that affiliates could use to disable endpoint detection and response software. The LockBit 5.0 ESXi variant can shut down running virtual machines, and the INC encryptor can delete snapshots.
  • TamperedChef: ads and search results distributed applications that did what they advertised, such as editing PDFs, but carried valid Extended Validation code-signing certificates obtained through a rotating network of U.S.-registered shell companies. When a certificate was revoked, the operators replaced it.
  • Other campaigns used GitHub repositories and cloud storage for distribution and messaging services to communicate with compromised systems, traffic that resembles routine business use.

Remediação

The article gives no vendor guidance. For defenders, the reported behaviours point to limiting agent permissions and requiring approval for executable tools, watching for reuse of stolen sessions and tokens, inventorying remote management tools on managed endpoints, patching Gitea and auditing its repositories and stored credentials, keeping backups and snapshots out of reach of intruders, and alerting on endpoint security tampering and on reuse of revoked code-signing certificates.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 10/11/2026 02:30 · coletado 10/11 04:01 primeiro registro

    Acronis report: AI agents, malicious OpenClaw skills and ransomware tooling drive intrusions

    ler a análise desta fonte

    The Acronis TRU Cyber Pulse 2026 report describes cybercriminals using AI agents to coordinate attacks, reusing stolen credentials and browser sessions to reach linked cloud services, and deploying tools that interfere with intrusion detection and system recovery. In the BOSSAI investigation, one operator connected more than 10 AI models to reconnaissance, scanning and exploitation tools through WeChat and LINE, with reported activity against emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico. The report also counts more than 575 malicious OpenClaw skills that delivered trojans, cryptocurrency miners and information stealers to Windows and macOS. Ransomware families including Qilin, The Gentlemen, LockBit 5.0 and INC target security tooling, shadow copies, snapshots and virtual machines. No vendor advisory or CVE is named in the article, and external research could not be completed for this record, so the facts below rest on the article alone.

    Technical Details

    • BOSSAI: reusable instructions carried procedures and target details from one campaign to the next, and several tools ran without approval prompts, so agents could pick and run them within their granted permissions.
    • OpenClaw skills: agent skills can pair instructions with executable code that uses permissions the agent already holds. On Hugging Face, malicious payloads were disguised as models, datasets and AI applications.
    • Session and credential abuse: a stolen browser session can reach connected cloud applications without a new MFA challenge, while repository credentials and API keys can expose source code and services tied to a developer account. Access can also be handed from one actor to another, including to ransomware operators or espionage groups.
    • Remote management: of more than 1.8 million endpoints running the vendor's own remote monitoring and management software, 63.1% had at least one additional remote management or remote access tool installed, some left over after a provider change.
    • Red Heron: a working public exploit appeared the day after Gitea issued a patch for a critical vulnerability. Attackers adapted it against internet-facing Gitea servers and, in confirmed breaches, stole repositories, collected credentials and moved to other systems.
    • Ransomware: a Qilin sample could terminate processes and delete Windows Volume Shadow Copies before encryption. The Gentlemen maintained tools that affiliates could use to disable endpoint detection and response software. The LockBit 5.0 ESXi variant can shut down running virtual machines, and the INC encryptor can delete snapshots.
    • TamperedChef: ads and search results distributed applications that did what they advertised, such as editing PDFs, but carried valid Extended Validation code-signing certificates obtained through a rotating network of U.S.-registered shell companies. When a certificate was revoked, the operators replaced it.
    • Other campaigns used GitHub repositories and cloud storage for distribution and messaging services to communicate with compromised systems, traffic that resembles routine business use.

    Remediation

    The article gives no vendor guidance. For defenders, the reported behaviours point to limiting agent permissions and requiring approval for executable tools, watching for reuse of stolen sessions and tokens, inventorying remote management tools on managed endpoints, patching Gitea and auditing its repositories and stored credentials, keeping backups and snapshots out of reach of intruders, and alerting on endpoint security tampering and on reuse of revoked code-signing certificates.