Chinese Cybercrime Infrastructure: OpenClaw / Paperclip Operation

OpenClawLog4ShellReact2ShellChinese Cybercrime

An automated Chinese cybercrime infrastructure blends large-scale exploitation with structured orchestration and direct monetization. Coordinated through a centralized backend and an agent-based workflow system, the operation conducts internet-scale reconnaissance via FOFA and 360Quake, exploits vulnerable web applications using React2Shell extracts AI API keys, Stripe credentials and database secrets, and immediately validates stolen data for financial gain. Primary targets are Web3 platforms, fintech services and cloud-native organizations.

Indicators of Compromise

Domains (3)

soft-silence-d978.13544681192.workers.devanson-aeromarine-ocularly.ngrok-free.devkf.unpkg.top

IPv4 (1)

124.220.164.14

Emails (3)

[email protected]fofa*@deltajohnsons.com[email protected]

Notes

Conclusion The OpenClaw / Paperclip infrastructure represents a maturation point in Chinese cybercrime operations — the transition from opportunistic, manual exploitation to a structured, workflow-driven attack platform with enterprise-grade operational management. The operation's combination of internet-scale reconnaissance, automated exploitation at hundreds of simultaneous targets, fileless C2 via decentralized NKN network, and immediate credential monetization creates an end-to-end cybercrime pipeline that is both highly scalable and difficult to detect with traditional security tools. Three aspects of this operation demand specific attention from defenders: <ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">The monetization layer is immediate. Stolen API keys are not bulk-dumped to dark web markets — they are validated and used or sold within hours. An organization that detects this exploitation pattern days after the fact should assume their Stripe, AI, and cloud credentials are already compromised and actively being monetized.</li><li style="list-style-type: disc; font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">The NKN-based fileless C2 is resistant to standard blocking. Domain and IP blacklists are ineffective against an agent that communicates via a decentralized blockchain P2P network and is delivered entirely in memory. Detection requires behavioral monitoring of process trees and network connections to nkn.org, not signature matching.</li><li style="list-style-type: disc; font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;">Scale is the primary defense challenge. At ~45,000 exploitation attempts and 5,374 active backdoors, this operation is running at a volume that makes targeted response impractical. The actor is not hunting specific organizations — they are systematically compromising every publicly exposed vulnerable React and Java application they can find via FOFA. The correct defensive posture is eliminating the vulnerability, not monitoring for targeting.</li></ul> Any organization operating in Web3, fintech, or cloud-native environments with publicly exposed React or Java applications should treat this threat as active and verified. The combination of FOFA visibility data and automated React2Shell/Log4Shell exploitation means unpatched applications will be found, exploited, and harvested on automated schedules. Patch application and .env secret migration are the only reliable mitigations.<div> </div>

Mitigation

Mitigation <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#1a2533;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Priority</th><th style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#1a2533;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Action</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#c0392b;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">CRITICAL</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(189, 195, 199); vertical-align: top; padding: 4pt 6pt; overflow: hidden; overflow-wrap: break-word;">Patch CVE-2025-55182 & CVE-2025-66478 (React2Shell) -- apply vendor advisory update across all React applications</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#c0392b;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">CRITICAL</td><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#f4f6f7;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Patch CVE-2021-44228 (Log4Shell) -- upgrade Log4j to 2.17.1+; disable JNDI lookups if patching is not immediately possible</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#c0392b;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">CRITICAL</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(189, 195, 199); vertical-align: top; padding: 4pt 6pt; overflow: hidden; overflow-wrap: break-word;">Block at perimeter: 124[.]220[.]164[.]14 (all ports), *.nkn.org:30003, soft-silence-*.workers.dev, d6[.]tfdl[.]net, deltajohnsons[.]com</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#c0392b;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">CRITICAL</td><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#f4f6f7;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Close .env web access -- deny /.env, /api/.env paths in web server config; move secrets to Secrets Manager (Vault, AWS SM, Azure KV)</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#c0392b;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">CRITICAL</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(189, 195, 199); vertical-align: top; padding: 4pt 6pt; overflow: hidden; overflow-wrap: break-word;">Rotate all exposed credentials: AI API keys (OpenAI, Anthropic, Gemini, DeepSeek), Stripe live keys, GitHub tokens, DB credentials</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#e67e22;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">HIGH</td><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#f4f6f7;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Update WAF rules: add React2Shell and Log4Shell JNDI blocking signatures; rate-limit IPs >100 req/min</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#e67e22;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">HIGH</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(189, 195, 199); vertical-align: top; padding: 4pt 6pt; overflow: hidden; overflow-wrap: break-word;">Deploy Sigma rules to SIEM: env variable dump from web process (CRITICAL), fileless curl|node pipe (HIGH), NKN outbound (HIGH)</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#e67e22;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">HIGH</td><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#f4f6f7;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Deploy YARA rules 7.1-7.4 to EDR/AV: React2Shell scripts, NKN agent, credential harvesting patterns, CF tunnel + P2P persistence</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#e67e22;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">HIGH</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(189, 195, 199); vertical-align: top; padding: 4pt 6pt; overflow: hidden; overflow-wrap: break-word;">Audit FOFA / Shodan exposure: scan own ASN for publicly visible React and Java applications; restrict or take offline unnecessary ones</td></tr><tr style="height:0pt;"><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#1a5276;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(255, 255, 255); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">MEDIUM</td><td style="border-left:solid #bdc3c7 0.5pt;border-right:solid #bdc3c7 0.5pt;border-bottom:solid #bdc3c7 0.5pt;border-top:solid #bdc3c7 0.5pt;vertical-align:top;background-color:#f4f6f7;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Configure API usage alerts: set spend limits and anomaly alerts for all AI API keys; monitor OpenAI, Anthropic, and Stripe dashboards</td></tr></tbody></table></div>