{ "Event": { "uuid": "875094b8-c444-56b7-9af6-4524d0de89cc", "info": "Korean Claude Code + OpenClaw Operator (221.150.15.104)", "date": "2026-05-27", "threat_level_id": 2, "analysis": 2, "timestamp": 1791727776, "publish_timestamp": 1791727776, "published": true, "Orgc": { "name": "The Hunters Ledger", "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d" }, "Tag": [ { "name": "tlp:clear", "colour": "#ffffff" }, { "name": "hunters-ledger:topic=\"AI Abuse\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Persistence\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Open Dir\"", "colour": "#58a6ff" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1685\"", "colour": "#0088cc" } ], "Attribute": [ { "uuid": "d8951ab8-6d32-5648-aff6-91b44e25b0dc", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "to_ids": false, "comment": "Detection rules, The Hunters Ledger", "timestamp": 1791727776 }, { "uuid": "3d3e82a3-f689-5c97-aef9-7f110ac91ed6", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/ioc-feeds/korean-claude-openclaw-221.150.15.104-iocs.json", "to_ids": false, "comment": "IOC feed (JSON), The Hunters Ledger", "timestamp": 1791727776 }, { "uuid": "6303e441-2117-5a94-8ca8-a1941195e3cc", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/", "to_ids": false, "comment": "Report, The Hunters Ledger", "timestamp": 1791727776 }, { "uuid": "5d33710a-d663-5b3b-a519-46774c57b262", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/stix/korean-claude-openclaw-221.150.15.104.json", "to_ids": false, "comment": "STIX 2.1 bundle, The Hunters Ledger", "timestamp": 1791727776 }, { "uuid": "fedc01a3-b5bd-5dee-b319-33063b1c4525", "type": "domain", "category": "Network activity", "value": "docs.openclaw.ai", "to_ids": true, "comment": "domain: docs.openclaw.ai. OpenClaw documentation host; referenced in operator's pre-approved Claude Code WebFetch allowlist entry, Same dual-use status as openclaw.ai parent domain [confidence 95/100]", "timestamp": 1791727776 }, { "uuid": "2a45395f-f801-5379-b4c6-a9678990d013", "type": "domain", "category": "Network activity", "value": "lightmake.site", "to_ids": true, "comment": "domain: lightmake.site. OpenClaw-adjacent infrastructure component referenced in parent-investigation hosting-and-egress signature list, Not directly observed in Case 4 artifact; promoted to this feed from parent investigation umbrella's OpenClaw ecosystem documentation [confidence 60/100]", "timestamp": 1791727776 }, { "uuid": "736010be-95ee-576c-b6c1-10443b40436f", "type": "domain", "category": "Network activity", "value": "openclaw.ai", "to_ids": true, "comment": "domain: openclaw.ai. OpenClaw product / installer hosting domain; referenced in operator's pre-approved Claude Code allowlist as the curl|bash installer source, Dual-use: publicly distributed AI-agent framework with both legitimate-purpose adopters and confirmed-malicious operators (this case + Case 2 Turkish ARPA + Case 7 Korean operator) [confidence 95/100]", "timestamp": 1791727776 }, { "uuid": "28607067-db07-5156-b670-6ed27c043ed8", "type": "url", "category": "Network activity", "value": "http://221.150.15.104:8080/", "to_ids": true, "comment": "url: http://221.150.15.104:8080/. Operator-exposed open directory leaking ~/.claude/ and ~/.openclaw/ home-directory contents [confidence 95/100]", "timestamp": 1791727776 }, { "uuid": "82c36503-61b0-5a9e-81bf-e924aae7e305", "type": "url", "category": "Network activity", "value": "https://openclaw.ai/install.sh", "to_ids": true, "comment": "url: https://openclaw.ai/install.sh. OpenClaw shell installer fetched via curl|bash pattern; operator pre-authorized this exact URL in Claude Code allowlist [confidence 95/100]", "timestamp": 1791727776 }, { "uuid": "e00c2582-d82e-5f33-bf2d-3d5b35ac77b4", "type": "ip-dst", "category": "Network activity", "value": "221.150.15.104", "to_ids": true, "comment": "ipv4: 221.150.15.104. Operator residential exposure (Korea Telecom AS4766); open directory on port 8080 leaked ~/.claude/ and ~/.openclaw/ contents [confidence 95/100]", "timestamp": 1791727776 }, { "uuid": "8a56c0dd-81ff-5ef4-a9e1-9c0078b51703", "type": "sigma", "category": "Payload installation", "value": "title: Claude Code settings.local.json Written Under Root or a Home Directory\nid: 54d80e73-2b2d-4932-a97b-d431db41c501\nstatus: experimental\ndescription: >-\n Detects creation or modification of a Claude Code settings.local.json file. Sigma\n file_event rules match path metadata only in most back ends, so this rule alone cannot\n confirm OpenClaw-specific allowlist content is present — pair with a YARA content scan\n for that confirmation. Because Claude Code writes this path during routine interactive\n use, hits require triage rather than automatic alerting; this rule is a scoping lead,\n not a high-confidence indicator by itself.\nreferences:\n - https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/\n - https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-27'\ntags:\n - attack.stealth\n - attack.defense-impairment\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: file_event\n product: linux\ndetection:\n selection_path:\n TargetFilename|startswith:\n - '/root/'\n - '/home/'\n TargetFilename|endswith: '/.claude/settings.local.json'\n TargetFilename|re: '(/root|/home/[^/]+)/\\.claude/settings\\.local\\.json'\n condition: selection_path\nfalsepositives:\n - >-\n Routine Claude Code operation on any developer host — this file is written or\n updated whenever a user accepts a new tool permission, which is common, everyday\n interactive activity, not evidence of attacker customization by itself.\n - >-\n Legitimate OpenClaw adopters on developer-class workstations who have explicitly\n added OpenClaw allowlist entries to their own Claude Code configuration.\nlevel: medium", "to_ids": false, "comment": "Claude Code settings.local.json Written or Modified | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1685 | rule hash f9fbeee8 | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "ec1298ad-3023-5e8a-a1c8-2b0635ece854", "type": "sigma", "category": "Payload installation", "value": "title: Command Line With Curl, openclaw.ai and a Pipe-to-Shell Fragment (OpenClaw Installer Shape)\nid: e02ddbf4-0a77-4c13-85ac-cd1ed9d8e66d\nstatus: experimental\ndescription: >-\n Detects a command line that holds the substrings curl and openclaw.ai together with a\n pipe-to-shell fragment (| bash, |bash, | sh or |sh), in any order and without token\n boundaries. The pattern curl fetching from openclaw.ai piped to bash is the primary\n distribution mechanism documented in the Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104\n operator campaign. This rule cannot distinguish execution under an attacker-customized\n Claude Code allowlist from a legitimate developer manually installing OpenClaw — both\n produce the identical command line — so hits require review rather than automatic alerting.\nreferences:\n - https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/\n - https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-27'\ntags:\n - attack.execution\n - attack.stealth\n - attack.defense-impairment\n - attack.t1059.004\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n CommandLine|contains|all:\n - 'curl'\n - 'openclaw.ai'\n CommandLine|contains:\n - '| bash'\n - '|bash'\n - '| sh'\n - '|sh'\n condition: selection\nfalsepositives:\n - >-\n Legitimate OpenClaw evaluation or installation on developer-class workstations, run\n manually and independent of any Claude Code allowlist.\nlevel: medium", "to_ids": false, "comment": "Command Line With Curl, openclaw.ai and a Pipe-to-Shell Fragment (OpenClaw Installer Shape) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1059.004, T1685 | rule hash ab2f01fa | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "d3f499f9-0bb5-5821-9f14-b598fa65062b", "type": "sigma", "category": "Payload installation", "value": "title: NPM Registry Fetch for OpenClaw Package\nid: d3a240e8-79a9-44d7-8b51-199389276d28\nstatus: experimental\ndescription: >-\n Detects HTTP requests to the npm registry (registry.npmjs.org) for the openclaw package\n name — the alternative installation path for the OpenClaw AI-agent framework documented\n in the Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104 operator campaign. Cannot\n distinguish attacker-driven installation from legitimate developer evaluation of the\n same dual-use package, so hits require review on developer-class hosts.\nreferences:\n - https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/\n - https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-27'\ntags:\n - attack.command-and-control\n - attack.t1105\n - detection.emerging-threats\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-host: 'registry.npmjs.org'\n cs-uri-stem|contains: 'openclaw'\n condition: selection\nfalsepositives:\n - >-\n Legitimate developers evaluating or installing OpenClaw on sanctioned developer\n workstations.\nlevel: medium", "to_ids": false, "comment": "NPM Registry Fetch for OpenClaw Package | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1105 | rule hash ef9ca0e0 | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "d7f61a49-0e03-5988-80ff-c338431a2ca2", "type": "sigma", "category": "Payload installation", "value": "title: OpenClaw AI-Agent Gateway Service Started\nid: f6a6901a-73dc-49c9-8c05-5ca64aa89d23\nstatus: experimental\ndescription: >-\n Detects invocation of the OpenClaw local-gateway service via the 'openclaw gateway\n --port' command pattern, requiring both the openclaw binary image and the gateway/port\n arguments together. The OpenClaw gateway functions as a local control-plane proxy\n between Claude Code and downstream OpenClaw skills — its startup indicates the operator\n has completed installation and is bringing up the AI-agent control plane. Observed as\n allowlist entry 6 in the Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104 campaign.\n Legitimate adopters running the same gateway trigger this identically, so hits require\n review rather than automatic alerting.\nreferences:\n - https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/\n - https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-27'\ntags:\n - attack.command-and-control\n - attack.t1090.001\n - attack.stealth\n - attack.defense-impairment\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_image:\n Image|endswith: '/openclaw'\n selection_cmdline:\n CommandLine|contains|all:\n - 'gateway'\n - '--port'\n condition: selection_image and selection_cmdline\nfalsepositives:\n - >-\n Legitimate OpenClaw adopters on developer-class workstations running the gateway\n for sanctioned evaluation or use.\nlevel: medium", "to_ids": false, "comment": "OpenClaw Gateway Service Started | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1090.001, T1685 | rule hash ae8f4315 | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "a4d18312-4864-554b-941f-a7817bbfe488", "type": "yara", "category": "Payload installation", "value": "/*\n Yara Rule Set\n Identifier: Claude Code Attacker-Customized Allowlist — OpenClaw Operator (Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104)\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule TOOL_ClaudeCode_OpenClaw_Allowlist_Specific {\n meta:\n description = \"Detects a small file (under 10 KB) that carries at least three of six distinct OpenClaw permission-allowlist entries as found in the operator's Claude Code settings.local.json: the curl|bash installer, npm global install, onboarding, docs fetch, gateway start, and UI launch. A legitimate OpenClaw adopter who allowlists the same documented steps produces the same file\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\"\n date = \"2026-05-27\"\n family = \"AI-Agent Allowlist Abuse\"\n malware_type = \"Operator Tradecraft / AI-Agent Permission Bypass\"\n campaign = \"Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104\"\n id = \"98965454-3e39-59be-8b73-d9e5451d3a11\"\n strings:\n $oc_install = \"Bash(curl -fsSL https://openclaw.ai/install.sh | bash)\" ascii fullword\n $oc_npm = \"Bash(npm i -g openclaw)\" ascii fullword\n $oc_onboard = \"Bash(openclaw onboard)\" ascii fullword\n $oc_webfetch = \"WebFetch(domain:docs.openclaw.ai)\" ascii fullword\n $oc_gateway = \"Bash(openclaw gateway --port\" ascii\n $oc_openui = \"Bash(open http://127.0.0.1:18789/)\" ascii fullword\n condition:\n filesize < 10KB and\n 3 of ($oc_install, $oc_npm, $oc_onboard, $oc_webfetch, $oc_gateway, $oc_openui)\n}", "to_ids": false, "comment": "OpenClaw-Specific Claude Code Allowlist | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1685, T1059.004 | rule hash d6e2291d | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "3ab9fb21-915d-5c66-a5b3-02c5cc1e8f7d", "type": "yara", "category": "Payload installation", "value": "rule TOOL_ClaudeCode_CurlBash_Allowlist_Generic {\n meta:\n description = \"Detects a small file (under 10 KB) with the permissions and allow keys and a single allowlist entry of the form Bash(curl ... | bash) or Bash(curl ... | sh), a heuristic lead for attacker-customized AI-agent allowlists regardless of which tooling is being installed. Developers who pre-approve an internal installer produce the same entry\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/\"\n date = \"2026-05-27\"\n family = \"AI-Agent Allowlist Abuse\"\n malware_type = \"Operator Tradecraft / AI-Agent Permission Bypass\"\n campaign = \"Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104\"\n id = \"ae126881-077c-513d-bd87-bd8b56944fcc\"\n strings:\n $permissions_block = \"\\\"permissions\\\"\" ascii\n $allow_block = \"\\\"allow\\\"\" ascii\n $curl_pipe = /Bash\\(curl[^\\x22\\r\\n]*\\| ?(ba)?sh\\)/ ascii\n condition:\n filesize < 10KB and\n $permissions_block and\n $allow_block and\n $curl_pipe\n}", "to_ids": false, "comment": "Generic Curl-Pipe-Bash Pattern in Claude Code Allowlist | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1685, T1059.004 | rule hash 45043f5a | https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/", "timestamp": 1791727776, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] } ], "Object": [] } }