EN PT-BR
← Voltar ao feed
high government emergency_services education financial

Single operator's AI-agent mesh (BOSSAI) hit emergency, government, university and finance targets in three countries

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 11:19 · coletado há 1 hora

A single operator ran the BOSSAI campaign, which the Acronis Threat Research Unit (TRU) documents in its Cyber Pulse 2026 report (acronis.com/en/tru). The operator used more than ten AI models to pick victims and run attack infrastructure, with targets in Taiwan (emergency services and government systems), Thailand (universities) and Mexico (financial organizations). Commands reached the tools through messaging apps such as WeChat and LINE. The report also covers over 575 malicious OpenClaw skills, infostealer theft of AI-tool API keys, LockBit 5.0 and Qilin ransomware against Linux, VMware ESXi and Windows Subsystem for Linux, and managed service providers as a single point of compromise. No CVE, KEV entry or vendor patch is named for these threats, and exposure of OpenClaw instances is not the same as compromise, which limits the immediate risk; the criticity is high because of the multi-country intrusions and the stolen-credential and supply-chain paths.

Detalhes técnicos

  • The BOSSAI mesh has 12 AI agents with separate, sometimes overlapping roles; its offensive core ran almost entirely on abliterated variants of DeepSeek, GLM and Qwen with safety alignment removed, and at peak it loaded 13 MCP servers for tools such as Kali Linux, Ghidra and Playwright (acronis.com/en/tru).
  • The OpenClaw malicious skills were published under 13 developer accounts and impersonated legitimate utilities (acronis.com/en/blog). According to the article, they delivered trojans, cryptocurrency miners and information stealers to Windows and macOS.
  • The article cites Censys data showing publicly reachable OpenClaw instances rising from about 1,000 to over 21,000 in under seven days.
  • Qilin used the Windows Subsystem for Linux to run a Linux encryptor on Windows; the group claimed 962 victims in the second half of 2025, a self-reported figure the article notes was not independently confirmed.
  • In the Red Heron investigation, attackers adapted a public exploit shortly after disclosure of a critical Gitea flaw. The article names no CVE for it.
  • The report describes deliberate disabling of security tools and activity logs, a practice that received its own MITRE ATT&CK category in 2026.

Remediação

  • Monitor administrative access and authenticated sessions, limit the permissions given to AI agents, speed up security updates and keep recovery tools separate from daily administration systems (olhardigital.com.br, citing the Acronis report).
  • Review remote-access tooling on managed endpoints; Acronis analysed more than 1.8 million endpoints on its RMM and found 63.1% had at least one extra remote-management or remote-access tool installed (acronis.com/en/blog).

Relatos divergentes

  • The article says more than ten AI models were used. The Acronis BOSSAI write-up (acronis.com/en/tru) counts a mesh of 12 AI agents, which the primary source describes in more detail; the difference is between agents and models and should be read against the Acronis count.

Linha do tempo

  1. olhardigital.com.br ↗ · pub. 09/11/2026 11:19 · coletado 09/11 12:00 primeiro registro

    Single operator's AI-agent mesh (BOSSAI) hit emergency, government, university and finance targets in three countries

    ler a análise desta fonte

    A single operator ran the BOSSAI campaign, which the Acronis Threat Research Unit (TRU) documents in its Cyber Pulse 2026 report (acronis.com/en/tru). The operator used more than ten AI models to pick victims and run attack infrastructure, with targets in Taiwan (emergency services and government systems), Thailand (universities) and Mexico (financial organizations). Commands reached the tools through messaging apps such as WeChat and LINE. The report also covers over 575 malicious OpenClaw skills, infostealer theft of AI-tool API keys, LockBit 5.0 and Qilin ransomware against Linux, VMware ESXi and Windows Subsystem for Linux, and managed service providers as a single point of compromise. No CVE, KEV entry or vendor patch is named for these threats, and exposure of OpenClaw instances is not the same as compromise, which limits the immediate risk; the criticity is high because of the multi-country intrusions and the stolen-credential and supply-chain paths.

    Technical Details

    • The BOSSAI mesh has 12 AI agents with separate, sometimes overlapping roles; its offensive core ran almost entirely on abliterated variants of DeepSeek, GLM and Qwen with safety alignment removed, and at peak it loaded 13 MCP servers for tools such as Kali Linux, Ghidra and Playwright (acronis.com/en/tru).
    • The OpenClaw malicious skills were published under 13 developer accounts and impersonated legitimate utilities (acronis.com/en/blog). According to the article, they delivered trojans, cryptocurrency miners and information stealers to Windows and macOS.
    • The article cites Censys data showing publicly reachable OpenClaw instances rising from about 1,000 to over 21,000 in under seven days.
    • Qilin used the Windows Subsystem for Linux to run a Linux encryptor on Windows; the group claimed 962 victims in the second half of 2025, a self-reported figure the article notes was not independently confirmed.
    • In the Red Heron investigation, attackers adapted a public exploit shortly after disclosure of a critical Gitea flaw. The article names no CVE for it.
    • The report describes deliberate disabling of security tools and activity logs, a practice that received its own MITRE ATT&CK category in 2026.

    Remediation

    • Monitor administrative access and authenticated sessions, limit the permissions given to AI agents, speed up security updates and keep recovery tools separate from daily administration systems (olhardigital.com.br, citing the Acronis report).
    • Review remote-access tooling on managed endpoints; Acronis analysed more than 1.8 million endpoints on its RMM and found 63.1% had at least one extra remote-management or remote-access tool installed (acronis.com/en/blog).

    Conflicting Reports

    • The article says more than ten AI models were used. The Acronis BOSSAI write-up (acronis.com/en/tru) counts a mesh of 12 AI agents, which the primary source describes in more detail; the difference is between agents and models and should be read against the Acronis count.