BOSSAI: lone operator's AI-agent mesh breaches Taiwan emergency services, universities and banks across 11 countries

Linha do tempo

1. olhardigital.com.br ↗ · pub. 09/11/2026 11:19 · coletado 09/11 12:00

   Single operator's AI-agent mesh (BOSSAI) hit emergency, government, university and finance targets in three countries

   ler a análise desta fonte ocultar

   A single operator ran the BOSSAI campaign, which the Acronis Threat Research Unit (TRU) documents in its Cyber Pulse 2026 report (acronis.com/en/tru). The operator used more than ten AI models to pick victims and run attack infrastructure, with targets in Taiwan (emergency services and government systems), Thailand (universities) and Mexico (financial organizations). Commands reached the tools through messaging apps such as WeChat and LINE. The report also covers over 575 malicious OpenClaw skills, infostealer theft of AI-tool API keys, LockBit 5.0 and Qilin ransomware against Linux, VMware ESXi and Windows Subsystem for Linux, and managed service providers as a single point of compromise. No CVE, KEV entry or vendor patch is named for these threats, and exposure of OpenClaw instances is not the same as compromise, which limits the immediate risk; the criticity is high because of the multi-country intrusions and the stolen-credential and supply-chain paths.

   Technical Details

   • The BOSSAI mesh has 12 AI agents with separate, sometimes overlapping roles; its offensive core ran almost entirely on abliterated variants of DeepSeek, GLM and Qwen with safety alignment removed, and at peak it loaded 13 MCP servers for tools such as Kali Linux, Ghidra and Playwright (acronis.com/en/tru).
   • The OpenClaw malicious skills were published under 13 developer accounts and impersonated legitimate utilities (acronis.com/en/blog). According to the article, they delivered trojans, cryptocurrency miners and information stealers to Windows and macOS.
   • The article cites Censys data showing publicly reachable OpenClaw instances rising from about 1,000 to over 21,000 in under seven days.
   • Qilin used the Windows Subsystem for Linux to run a Linux encryptor on Windows; the group claimed 962 victims in the second half of 2025, a self-reported figure the article notes was not independently confirmed.
   • In the Red Heron investigation, attackers adapted a public exploit shortly after disclosure of a critical Gitea flaw. The article names no CVE for it.
   • The report describes deliberate disabling of security tools and activity logs, a practice that received its own MITRE ATT&CK category in 2026.

   Remediation

   • Monitor administrative access and authenticated sessions, limit the permissions given to AI agents, speed up security updates and keep recovery tools separate from daily administration systems (olhardigital.com.br, citing the Acronis report).
   • Review remote-access tooling on managed endpoints; Acronis analysed more than 1.8 million endpoints on its RMM and found 63.1% had at least one extra remote-management or remote-access tool installed (acronis.com/en/blog).

   Conflicting Reports

   • The article says more than ten AI models were used. The Acronis BOSSAI write-up (acronis.com/en/tru) counts a mesh of 12 AI agents, which the primary source describes in more detail; the difference is between agents and models and should be read against the Acronis count.
2. securityonline.info ↗ · pub. 09/11/2026 05:00 · coletado 09/11 06:00

   BOSSAI: lone operator's 12-agent AI attack mesh breaches Taiwan emergency services and universities

   ler a análise desta fonte ocultar

   Acronis Threat Research Unit (TRU) describes BOSSAI as a campaign run by a single operator who coordinated a 12-agent AI mesh against hundreds of organizations in 11 countries over about 12 days, with roughly 10 breaches (securityonline.info). TRU classifies the operator as an AI-augmented threat actor (AAT) and says it used commercial models for infrastructure work, while offensive tasks moved to locally hosted abliterated DeepSeek, GLM and Qwen variants after cloud models refused attack requests (securityonline.info, acronis.com). The reported data theft includes medical records and ECG readings from a Taipei fire-department platform, 119 emergency dispatch logs, and student and administrator tables from Thai universities (securityonline.info). The activity relies on classic web flaws such as SQL injection, and no vendor vulnerability or patch is involved, so the danger is an active intrusion campaign rather than a new flaw. Attribution to one individual rests on operational-security mistakes that tied the offensive server to a residential IP also used by legitimate storefronts (securityonline.info).

   Technical Details

   The operator split the mesh into two groups. Infrastructure agents (Grok 4.5, OpenClaw, Claude Code and Codex CLI) built Model Context Protocol servers, configured DNS and repaired scripts, while offensive agents (Hermes, HalberdStrike, CyberStrike, Cursor and Trae) scanned targets and launched exploits through a Kali Linux MCP server, HexStrike AI and a cracked copy of Acunetix Web Vulnerability Scanner (securityonline.info). The operator passed outputs between agents by hand, copying text between terminal windows (securityonline.info). At its peak the mesh loaded 13 MCP servers, and the local models ran on an RTX 4090 host through llama.cpp (acronis.com).

   Hermes ran an abliterated DeepSeek-V4 model, called DS4, across 95 sessions, issuing over 3,300 terminal commands and 561 sqlmap calls (securityonline.info). HalberdStrike produced fabricated CVE claims in its critical findings (securityonline.info, acronis.com). A SQL injection on a legacy subdomain running Oracle 9.2.0.4.0 was confirmed as a Boolean-based blind injection, from which the agent extracted an administrator table (acronis.com).

   Victim impact reported by securityonline.info includes an unprotected Taipei fire-department platform exposing 2018 patient ECG readings, ambulance videos and vital signs, 119 dispatch records across seven Taipei districts, account tables from a Taiwanese lender through 16 MSSQL injection points, and a CVV check bypass on a mobile payment app. In Thailand, Hermes scanned 489 targets across 45 universities and dumped student and admin tables at three institutions. In Mexico, agents collected roughly 206,800 residential phone records and 124,000 yellow-pages listings.

   Remediation

   The article recommends removing default credentials on database administration panels, patching legacy SQL servers, requiring strict authentication on all public-facing APIs, blocking the command server at 112.121.185.218, and watching web logs for bursts of sqlmap, nikto and ffuf scanning (securityonline.info). No vendor patch applies because the activity exploits misconfigurations and classic flaws rather than a single product vulnerability.

   Conflicting Reports

   • securityonline.info states that Hermes made 561 sqlmap calls; the TRU report counts sqlmap in 561 messages across sessions, which is a different measure (acronis.com).
   • securityonline.info says Hermes found a Honduran military air-force personnel system; the TRU report describes a Honduran military host or base that the agent deemed out of scope and did not pursue (acronis.com).
   • The handle 'bossjy', the Hualien City location and the Guangzhou GPU cluster appear in the article; they were not found in the TRU page opened during research, so they remain attributed to securityonline.info only (acronis.com).
3. gbhackers.com ↗ · pub. 05/11/2026 04:22 · coletado 05/11 06:00 primeiro registro

   BOSSAI: AI-Agent Mesh Operated by Lone Actor Breaches Taiwan Emergency Services, Universities and Banks

   ler a análise desta fonte ocultar

   Acronis Threat Research Unit (TRU) uncovered BOSSAI, an agentic attack platform built from a mesh of 12 AI agents (nine active) operated by a single individual assessed with high confidence to be based in Hualien City, Taiwan. The campaign targeted hundreds of organizations across eleven countries, including emergency services, banks, universities, military systems and e-commerce platforms, with confirmed breaches at universities and emergency providers exposing medical data and PII. A Taipei fire department patient-care platform leaked ECG readings, ambulance video and patient vitals dating back to 2018 without credentials, alongside case records from the city's 119 dispatch system across seven districts. Reporting also links the campaign to theft of Thai university student data and over 200,000 Mexican residential phone records. TRU classifies the activity as an "AI-augmented threat" — a lone actor with APT-like reach but no clear political or financial motive.

   Technical Details

   Agents named Hermes, Cursor, Trae, CyberStrike and HalberdStrike scanned targets and built exploits, with the mesh at peak loading 13 Model Context Protocol servers exposing tools like nmap, sqlmap, Metasploit (via Kali), Ghidra, and CVE lookup utilities. Builders such as Grok, OpenClaw, Claude Code and Codex maintained infrastructure. Because commercial models refused offensive tasks, the operator used "abliterated" (safety-stripped) open-weight models — DeepSeek, GLM and Qwen variants on local RTX 4090 GPUs — with Hermes cycling through nine models before settling on a DeepSeek-V4 variant called DS4. In one documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated findings, and Cursor executed the exploit on operator instruction; Hermes alone ran ~95 sessions generating 18,311 messages. The platform also enumerated 50+ subdomains of a Thai university and exploited a blind SQL injection on an unpatched Oracle 9.2.0.4.0 host to dump student records. A C# Windows Forms tool supported full exploitation of Hikvision surveillance cameras via functions like keepAlive, applyCT and applyAutoLoginTicket. Over half of HalberdStrike's high/critical findings were false positives, and some models fabricated CVEs; excessive autonomy also caused agents to skip a Honduran military host judged "out of scope." TRU discovered the operation via a misconfigured development environment containing over 90,000 files (9GB) of agent logs and victim data.

   Remediation

   Acronis notes the underlying exposures predated AI involvement: a medical-data port open since 2018, unauthenticated dispatch APIs, a bank with 16 SQL-injection points, and unpatched Oracle databases. Defenders should close legacy exposures, authenticate public APIs, patch outdated database systems, and monitor for rapid, automated scanning patterns characteristic of AI-driven reconnaissance.