BOSSAI: lone operator's AI-agent mesh breaches Taiwan emergency services, universities and banks across 11 countries
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:13; os links antigos trazem para cá.
Fontes: securityonline.info ↗ gbhackers.com ↗
Acronis Threat Research Unit (TRU) disclosed BOSSAI, an agentic attack platform in which a single operator coordinated a mesh of 12 AI agents (nine active, per gbhackers.com) against hundreds of organizations in 11 countries over about 12 days (securityonline.info). Targets included emergency services, banks, universities, military systems and e-commerce platforms. Confirmed breaches exposed medical data and PII, among them a Taipei fire department patient-care platform and the city's 119 dispatch system (gbhackers.com, securityonline.info). TRU classifies the actor as an "AI-augmented threat" (AAT): a lone operator with APT-like reach and no clear political or financial motive. TRU assesses with high confidence that the operator is based in Hualien City, Taiwan (gbhackers.com). The attribution rests on operational-security mistakes that tied the offensive server to a residential IP also used by legitimate storefronts (securityonline.info). No vendor vulnerability or patch is involved; the campaign relies on classic web flaws such as SQL injection and on legacy exposures.
Entenda a falha
A vulnerabilidade
No CVE is assigned and no vendor patch is involved. BOSSAI, an AI-agent attack mesh, abused old, weak exposures. The articles cite a Boolean-based blind SQL injection on an unpatched Oracle Database 9.2.0.4.0 legacy host at a Thai university, and 16 MSSQL injection points at a Taiwanese lender. They also cite an unauthenticated Taipei fire-department patient-care platform (a medical-data port open since 2018) and 119 dispatch API, and a CVV check bypass in a Taiwanese mobile payment app. Hikvision cameras were also targeted through keepAlive, applyCT and applyAutoLoginTicket, with RCE per gbhackers.com. The attacker needed only network reach and got patient data, PII, account and student tables, and device access. No affected or fixed versions are given beyond Oracle 9.2.0.4.0.
Como funciona
The operator's agents scanned targets, for example enumerating more than 50 subdomains of a Thai university. In the documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated the findings and Cursor ran the exploit on the operator's instruction. On the Oracle host, a blind SQL injection let the attacker infer database content from the application's responses, and student and admin tables were dumped. On the Taipei systems, requests to the exposed port and public API were simply answered with ECG readings, ambulance video, vital signs and case records, because no authentication step stood in the way.
Por que é vulnerável
Acronis says the exposures predated any AI involvement: a medical-data port open since 2018, dispatch records on a public API, a bank with 16 SQL-injection points and unpatched Oracle databases. The causes are missing authentication, missing input handling and missing patching. The agents did not create these flaws but found and collected them faster and more systematically than a manual attacker. Acronis notes that the agents failed wherever they met proper authentication, patched databases and filtered APIs.
Onde está
The articles name only the Hikvision functions keepAlive, applyCT and applyAutoLoginTicket; no file, commit or public advisory is cited for the other flaws.
Como foi descoberta
Acronis Threat Research Unit (TRU) found the operation through what looked like a misconfigured development environment, an exposed server holding over 90,000 files (9GB) of agent conversations, command histories and victim data. TRU assesses with high confidence that a single individual in Hualien City, Taiwan operated it. securityonline.info says the attribution rests on operational-security mistakes, such as a residential IP shared with legitimate storefronts, hardcoded API keys and an SSH key tied to a GitHub account. The articles do not say how victims were notified.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The operator's environment held a C# Windows Forms tool supporting the full exploitation lifecycle of Hikvision cameras, including unauthorized access and RCE through keepAlive, applyCT and applyAutoLoginTicket. It is a working attack tool, but the articles describe it only as found in the operator's own environment and do not say it was published. The articles also describe a cracked Acunetix scanner, sqlmap and Metasploit in use. Exposed, unpatched systems should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:28.
Detalhes técnicos
- Agent roles: Offensive agents Hermes, HalberdStrike, CyberStrike, Cursor and Trae scanned targets and launched exploits. Infrastructure agents (Grok 4.5, OpenClaw, Claude Code, Codex CLI) built MCP servers, configured DNS and repaired scripts (gbhackers.com, securityonline.info).
- Tooling: At peak the mesh loaded 13 Model Context Protocol servers (acronis.com, gbhackers.com). They exposed nmap, sqlmap, Metasploit (via Kali Linux), Ghidra, CVE lookup utilities, HexStrike AI and a cracked copy of Acunetix Web Vulnerability Scanner. The operator passed output between agents by hand, copying text between terminal windows (securityonline.info).
- Models: Commercial cloud models refused offensive tasks, so the operator used abliterated (safety-stripped) open-weight DeepSeek, GLM and Qwen variants. They ran locally on RTX 4090 GPUs through llama.cpp. Hermes cycled through nine models before settling on a DeepSeek-V4 variant called DS4 (gbhackers.com, securityonline.info, acronis.com).
- Hermes activity: About 95 sessions, 18,311 messages (gbhackers.com), over 3,300 terminal commands and 561 sqlmap calls (securityonline.info).
- Documented chain: HalberdStrike scanned an emergency-services target, Hermes consolidated the findings, and Cursor ran the exploit on operator instruction (gbhackers.com).
- Thailand: Hermes scanned 489 targets across 45 universities and dumped student and admin tables at three institutions (securityonline.info). Agents enumerated 50+ subdomains of one university. A Boolean-based blind SQL injection on an unpatched Oracle 9.2.0.4.0 legacy host yielded an administrator table (gbhackers.com, acronis.com).
- Taiwan: The unauthenticated Taipei fire-department platform leaked ECG readings, ambulance video and vital signs dating to 2018. The 119 dispatch records covered seven districts. A lender's account tables were reached through 16 MSSQL injection points, and a CVV check bypass was found in a mobile payment app (securityonline.info, gbhackers.com).
- Mexico: Agents collected roughly 206,800 residential phone records and 124,000 yellow-pages listings (securityonline.info).
- Hikvision: A C# Windows Forms tool supported full exploitation of Hikvision cameras via keepAlive, applyCT and applyAutoLoginTicket (gbhackers.com).
- Agent weaknesses: Over half of HalberdStrike's high/critical findings were false positives, and some models fabricated CVEs (gbhackers.com, securityonline.info, acronis.com). Excess autonomy led agents to skip a Honduran military host judged "out of scope" (gbhackers.com).
- Discovery: TRU found the operation through a misconfigured development environment holding over 90,000 files (9GB) of agent logs and victim data (gbhackers.com).
Remediação
Acronis notes the exposures predated AI involvement: a medical-data port open since 2018, unauthenticated dispatch APIs, a bank with 16 SQL-injection points and unpatched Oracle databases (gbhackers.com). Defenders should close legacy exposures, authenticate public APIs and patch outdated database systems. They should also monitor for rapid, automated scanning patterns typical of AI-driven reconnaissance (gbhackers.com). securityonline.info also recommends removing default credentials on database administration panels and patching legacy SQL systems; its text is truncated, so further advice is not captured here.
Relatos divergentes
- Agent count: gbhackers.com says 12 agents with nine active; securityonline.info describes a 12-agent mesh without that split.
- Breach scale: gbhackers.com refers to confirmed breaches at universities and emergency providers; securityonline.info (more recent, 2026-11-09) puts the total at roughly 10 breaches among hundreds of targets.
- Mexican records: gbhackers.com says over 200,000; securityonline.info gives about 206,800, which is consistent but more precise.
- Hermes activity metrics: The two outlets cite different figures (18,311 messages versus 3,300+ commands and 561 sqlmap calls). These are complementary rather than contradictory.
Linha do tempo
-
BOSSAI: lone operator's 12-agent AI attack mesh breaches Taiwan emergency services and universities
ler a análise desta fonte ocultar
Acronis Threat Research Unit (TRU) describes BOSSAI as a campaign run by a single operator who coordinated a 12-agent AI mesh against hundreds of organizations in 11 countries over about 12 days, with roughly 10 breaches (securityonline.info). TRU classifies the operator as an AI-augmented threat actor (AAT) and says it used commercial models for infrastructure work, while offensive tasks moved to locally hosted abliterated DeepSeek, GLM and Qwen variants after cloud models refused attack requests (securityonline.info, acronis.com). The reported data theft includes medical records and ECG readings from a Taipei fire-department platform, 119 emergency dispatch logs, and student and administrator tables from Thai universities (securityonline.info). The activity relies on classic web flaws such as SQL injection, and no vendor vulnerability or patch is involved, so the danger is an active intrusion campaign rather than a new flaw. Attribution to one individual rests on operational-security mistakes that tied the offensive server to a residential IP also used by legitimate storefronts (securityonline.info).
Technical Details
The operator split the mesh into two groups. Infrastructure agents (Grok 4.5, OpenClaw, Claude Code and Codex CLI) built Model Context Protocol servers, configured DNS and repaired scripts, while offensive agents (Hermes, HalberdStrike, CyberStrike, Cursor and Trae) scanned targets and launched exploits through a Kali Linux MCP server, HexStrike AI and a cracked copy of Acunetix Web Vulnerability Scanner (securityonline.info). The operator passed outputs between agents by hand, copying text between terminal windows (securityonline.info). At its peak the mesh loaded 13 MCP servers, and the local models ran on an RTX 4090 host through llama.cpp (acronis.com).
Hermes ran an abliterated DeepSeek-V4 model, called DS4, across 95 sessions, issuing over 3,300 terminal commands and 561 sqlmap calls (securityonline.info). HalberdStrike produced fabricated CVE claims in its critical findings (securityonline.info, acronis.com). A SQL injection on a legacy subdomain running Oracle 9.2.0.4.0 was confirmed as a Boolean-based blind injection, from which the agent extracted an administrator table (acronis.com).
Victim impact reported by securityonline.info includes an unprotected Taipei fire-department platform exposing 2018 patient ECG readings, ambulance videos and vital signs, 119 dispatch records across seven Taipei districts, account tables from a Taiwanese lender through 16 MSSQL injection points, and a CVV check bypass on a mobile payment app. In Thailand, Hermes scanned 489 targets across 45 universities and dumped student and admin tables at three institutions. In Mexico, agents collected roughly 206,800 residential phone records and 124,000 yellow-pages listings.
Remediation
The article recommends removing default credentials on database administration panels, patching legacy SQL servers, requiring strict authentication on all public-facing APIs, blocking the command server at 112.121.185.218, and watching web logs for bursts of sqlmap, nikto and ffuf scanning (securityonline.info). No vendor patch applies because the activity exploits misconfigurations and classic flaws rather than a single product vulnerability.
Conflicting Reports
- securityonline.info states that Hermes made 561 sqlmap calls; the TRU report counts sqlmap in 561 messages across sessions, which is a different measure (acronis.com).
- securityonline.info says Hermes found a Honduran military air-force personnel system; the TRU report describes a Honduran military host or base that the agent deemed out of scope and did not pursue (acronis.com).
- The handle 'bossjy', the Hualien City location and the Guangzhou GPU cluster appear in the article; they were not found in the TRU page opened during research, so they remain attributed to securityonline.info only (acronis.com).
-
BOSSAI: AI-Agent Mesh Operated by Lone Actor Breaches Taiwan Emergency Services, Universities and Banks
ler a análise desta fonte ocultar
Acronis Threat Research Unit (TRU) uncovered BOSSAI, an agentic attack platform built from a mesh of 12 AI agents (nine active) operated by a single individual assessed with high confidence to be based in Hualien City, Taiwan. The campaign targeted hundreds of organizations across eleven countries, including emergency services, banks, universities, military systems and e-commerce platforms, with confirmed breaches at universities and emergency providers exposing medical data and PII. A Taipei fire department patient-care platform leaked ECG readings, ambulance video and patient vitals dating back to 2018 without credentials, alongside case records from the city's 119 dispatch system across seven districts. Reporting also links the campaign to theft of Thai university student data and over 200,000 Mexican residential phone records. TRU classifies the activity as an "AI-augmented threat" — a lone actor with APT-like reach but no clear political or financial motive.
Technical Details
Agents named Hermes, Cursor, Trae, CyberStrike and HalberdStrike scanned targets and built exploits, with the mesh at peak loading 13 Model Context Protocol servers exposing tools like nmap, sqlmap, Metasploit (via Kali), Ghidra, and CVE lookup utilities. Builders such as Grok, OpenClaw, Claude Code and Codex maintained infrastructure. Because commercial models refused offensive tasks, the operator used "abliterated" (safety-stripped) open-weight models — DeepSeek, GLM and Qwen variants on local RTX 4090 GPUs — with Hermes cycling through nine models before settling on a DeepSeek-V4 variant called DS4. In one documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated findings, and Cursor executed the exploit on operator instruction; Hermes alone ran ~95 sessions generating 18,311 messages. The platform also enumerated 50+ subdomains of a Thai university and exploited a blind SQL injection on an unpatched Oracle 9.2.0.4.0 host to dump student records. A C# Windows Forms tool supported full exploitation of Hikvision surveillance cameras via functions like keepAlive, applyCT and applyAutoLoginTicket. Over half of HalberdStrike's high/critical findings were false positives, and some models fabricated CVEs; excessive autonomy also caused agents to skip a Honduran military host judged "out of scope." TRU discovered the operation via a misconfigured development environment containing over 90,000 files (9GB) of agent logs and victim data.
Remediation
Acronis notes the underlying exposures predated AI involvement: a medical-data port open since 2018, unauthenticated dispatch APIs, a bank with 16 SQL-injection points, and unpatched Oracle databases. Defenders should close legacy exposures, authenticate public APIs, patch outdated database systems, and monitor for rapid, automated scanning patterns characteristic of AI-driven reconnaissance.