CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BOSSAI

campaign · campaign:bossai-ai-attack-mesh-taiwan-2026-11 single-source

Agentic attack campaign that Acronis TRU attributes with high confidence to a single operator in Taiwan: a mesh of 12 AI agents, nine active, that over 12 observed days targeted emergency services, banks, universities and military systems in 11 countries and took patient-care and dispatch records from Taiwanese emergency services.

Coverage
1
first 2026-11-07 → last 2026-11-07
Latest activity
2026-11-07
BOSSAI AI agents took emergency-services data through open ports, public APIs and default credentials
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, healthcare · regions: apac
Sources cited
1
1 hosts

Defender insights

What each entry about BOSSAI tells a defender to do, newest first.

2026-11-07NOTABLEBOSSAI AI agents took emergency-services data through open ports, public APIs and default credentials

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

Story timeline

  1. 2026-11-07Acronis TRU on BOSSAI: one operator's mesh of 12 AI agents took patient-care records and dispatch case data from Taiwanese emergency services through a legacy open port, a public API and default root credentials, and failed wherever authentication was enforced
    active-threatsBOSSAI AI agents took emergency-services data through open ports, public APIs and default credentials

Hunting pivots

Tags
ai-abusedata-breach
ATT&CK techniques (5 across 7 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning: Vulnerability Scanning
  • Initial AccessValid Accounts: Default Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts: Default Accounts
  • Privilege EscalationValid Accounts: Default Accounts
  • StealthValid Accounts: Default Accounts
  • Credential AccessBrute Force
  • CollectionAutomated Collection

Reconnaissance TA0043

T1595.002Active Scanning: Vulnerability Scanning×1

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Initial Access TA0001

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Persistence TA0003

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Privilege Escalation TA0004

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Stealth TA0005

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Credential Access TA0006

T1110Brute Force×1

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Collection TA0009

T1119Automated Collection×1

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

Evidence: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan · ATT&CK page ↗

Entries about BOSSAI (1)

2026-11-07 · view entry permalink →

NOTABLENATOB3

Acronis TRU on BOSSAI: one operator's mesh of 12 AI agents took patient-care records and dispatch case data from Taiwanese emergency services through a legacy open port, a public API and default root credentials, and failed wherever authentication was enforced

Acronis TRU found an open attack workstation holding more than 90,000 files and describes BOSSAI as a mesh of 12 AI agents, nine active, driven by a changing roster of language models, with the operator acting as the bridge between agents and typing commands in Traditional Chinese (Acronis TRU, 2026-11-04). The agents that executed attacks ran almost exclusively on abliterated open-weight models run locally, after commercial models repeatedly refused offensive requests (Acronis TRU, 2026-11-04). In the 12 days TRU observed, the operator targeted government emergency services, banks and lenders, universities and military systems in 11 countries, with confirmed exfiltration or system access at roughly ten targets in three countries and about fifteen more attacked without confirmed compromise (Acronis TRU, 2026-11-04).

The confirmed emergency-services harm is the part that matters here. A Taipei fire-department patient-care records platform exposed ECG readings, ambulance video and vital signs from 2018, accessible without credentials; a city's 119 dispatch system yielded case records with incident times, response types, status fields and street-level locations across seven districts from the system's API; and a fire-dispatch vendor's database administration panel opened with default root credentials, exposing 18 or more tables (Acronis TRU, 2026-11-04). In an emergency-management system the agents found a hardcoded AES-256 key in front-end JavaScript that exposed session-cookie contents, an administrator identity among them, and a partial server-side request forgery path, without confirming a full compromise (Acronis TRU, 2026-11-04). A brute-force run against a national fire agency's single sign-on portal gave no confirmed access, and the critical Apache flaw that the operator's vulnerability platform reported at a disaster-response centre was fabricated, because the port was filtered (Acronis TRU, 2026-11-04). TRU says the agents failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered, and that obscurity no longer protects a system from agents that investigate hundreds of targets at once (Acronis TRU, 2026-11-04).

TRU assesses with high confidence that the infrastructure and activity were operated by a single individual based in Hualien City, Taiwan.

Confirmed data exfiltration or system access occurred at roughly 10 distinct targets across three countries.

The agents failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered.

Acronis Threat Research Unit 2026-11-04
threat07 Nov 03:59Zsingle-sourceOpen finding →
Sources: Acronis Threat Research Unit

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • acronis.com1 (100%)
All cited sources (1)