Acronis says lone operator used 12 AI agents against Taiwan emergency services

What happened

Cyber Security News reports that the Acronis Threat Research Unit says one operator in Taiwan built a setup called BOSSAI. Acronis says BOSSAI is a mesh of 12 AI agents and that the operator used it to attack hundreds of organizations in 11 countries. Acronis reports that the targets included emergency services, banks, universities and military systems. These are the researchers’ findings as reported by a single outlet. The affected organizations have not confirmed them in the sources, and no independent verification is available.

According to Cyber Security News, Acronis found the campaign when it came across what looked like a misconfigured development server. Acronis says the server held a full attack platform. It reports more than 90,000 files, about 9GB of logs, chat histories, exploit tools and victim data on the server (Cyber Security News).

The outlet reports the following about how Acronis says the agents were set up:

• Agents in use: Nine of the 12 agents were active.
• Builder agents: Grok, OpenClaw, Claude Code and Codex set up servers, DNS and proxies.
• Attack agents: Hermes, Cursor, Trae and CyberStrike scanned targets and wrote exploits. Hermes logged about 95 sessions and 18,311 messages.
• Coordination: The agents did not communicate with each other. The operator copied output from one tool into the next.
• Tool connections: The agents were linked to security tools through MCP servers. These included HexStrike AI, a Kali Linux server and a Ghidra bridge.

(Cyber Security News)

Cyber Security News, citing Acronis, describes these victims:

• Taipei fire department: A patient-care platform exposed ECG readings, ambulance video and vital signs from 2018, with no login needed.
• City 119 dispatch system: Case records covering seven districts were pulled.
• Lender: 16 SQL injection points were found.
• Fire-dispatch vendor: Its database panel still used default root credentials.
• Mexico: About 206,800 residential phone records were collected.
• Thailand: The agents found 489 targets across 45 universities and pulled data from three of them.

The outlet says the campaign led to “confirmed theft” of medical data and personal records. The sources do not name the individual organizations, and none of them has confirmed the incidents in the sources (Cyber Security News).

Acronis also reports several limits on what the agents could do (Cyber Security News):

• Model refusals: Commercial models such as Grok 4.5 and MiniMax M3 refused to help with attacks. The operator then switched to local “abliterated” models, which were weaker.
• False positives: More than half of the high-severity findings from a scanner called HalberdStrike were false positives.
• What worked: The agents mostly succeeded against old open ports, unpatched Oracle databases and default passwords.
• What failed: The agents failed where login checks and filtering held.

Acronis ties the activity, with high confidence, to one person in Hualien City, Taiwan. It bases this on reused business branding, a GitHub account and a home IP (Cyber Security News).

Not confirmed: the sources name no CVEs, give no full victim list and include no response from the affected organizations.

Am I affected?

• The sources do not name the affected organizations. They describe only a Taipei fire-department platform, a city 119 dispatch system, a lender, a fire-dispatch vendor, and targets in Mexico and Thailand.
• According to Acronis, the campaign succeeded against systems with weak basic security (Cyber Security News):
  • old open ports
  • unpatched Oracle databases
  • default credentials
  • APIs or panels reachable without a login
• If you run any of these, check your logs for the indicators listed below.

What to do now

1. Search firewall, proxy and DNS logs for the indicators of compromise published by Cyber Security News (Cyber Security News). The indicators are shown defanged, as published.
   • IPs: 112[.]121[.]185[.]218, 156[.]240[.]109[.]26, 49[.]158[.]237[.]136, 202[.]160[.]76[.]153, 202[.]160[.]76[.]154, 202[.]160[.]76[.]155, 202[.]160[.]76[.]156, 202[.]160[.]76[.]157, 202[.]160[.]76[.]174
   • Domains: vps[.]xs1[.]ccwu[.]cc, xss[.]xs1[.]ccwu[.]cc, c[.]xs1[.]ccwu[.]cc, attacker-collector[.]com, boss[.]jytian[.]cc[.]cd, gdp[.]gasjy[.]kdns[.]fr, gds[.]gasjy[.]kdns[.]fr, 888[.]bossjy[.]kdns[.]fr, ssh[.]gputw[.]ai
2. Remove default credentials, especially on database admin panels (Cyber Security News).
3. Patch exposed databases and close old open ports (Cyber Security News).
4. Require a login on every API, including APIs that serve dispatch and medical data (Cyber Security News).

Sources

• Cyber Security News: One Hacker Uses 12 AI Agents to Breach Taiwan’s Emergency Services and Steal Sensitive Data