BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

Key facts for BOSSAI AI agent mesh

Detection coverage for BOSSAI AI agent mesh

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5309 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BOSSAI Automated Web Scanning and SQL Injection Tooling (sqlmap/nikto/ffuf/gobuster/dirsearch)

TL-2026-5309 BOSSAI: the AI-driven operator mesh drove sqlmap (boolean-based blind SQLi against legacy Oracle 9.2.0.4.0), nikto, ffuf, gobuster, dirsearch, nmap and a cracked Acunetix build against public web applications through Kali/HexStrike MCP servers. Flags clients using these scanner user-agents or sending SQLi payload strings at volume.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002, T1046
• Data sources: apache_access_combined, nginx_access, iis_w3c
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h
```BOSSAI TL-2026-5309: scanner user-agents (sqlmap, nikto, ffuf, gobuster, dirsearch, acunetix) or SQLi payload strings```
| eval ua=lower(coalesce(useragent,""))
| eval tool=case(like(ua,"%sqlmap%"),"sqlmap", like(ua,"%nikto%"),"nikto", like(ua,"%ffuf%"),"ffuf", like(ua,"%gobuster%"),"gobuster", like(ua,"%dirsearch%"),"dirsearch", like(ua,"%acunetix%") OR like(ua,"%wvs%"),"acunetix", like(ua,"%nmap%"),"nmap_nse", true(),null())
| eval sqli=if(match(lower(_raw),"(sleep|waitfor.{1,5}delay|union.{1,5}select|extractvalue|dbms_pipe|utl_inaddr|and.{1,5}[0-9]+=[0-9]+)"),1,0)
| where isnotnull(tool) OR sqli=1
| stats count AS requests dc(uri_path) AS unique_paths sum(sqli) AS sqli_hits count(eval(status>=500)) AS server_errors values(tool) AS tools min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where requests>=20 OR sqli_hits>=5
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(24h)
| extend ua = tolower(csUserAgent), q = tolower(strcat(csUriStem, "?", csUriQuery))
| extend tool = case(ua has "sqlmap", "sqlmap", ua has "nikto", "nikto", ua has "ffuf", "ffuf", ua has "gobuster", "gobuster", ua has "dirsearch", "dirsearch", ua has "acunetix" or ua has "wvs", "acunetix", ua has "nmap", "nmap_nse", "")
| extend sqli = q matches regex @"(sleep|waitfor.{1,5}delay|union.{1,5}select|extractvalue|dbms_pipe|utl_inaddr|and.{1,5}[0-9]+=[0-9]+)"
| where tool != "" or sqli
| summarize Requests=count(), UniquePaths=dcount(csUriStem), SqliHits=countif(sqli), ServerErrors=countif(scStatus >= 500), Tools=make_set(tool), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by cIP, sSiteName
| where Requests >= 20 or SqliHits >= 5

Sigma

title: BOSSAI Web Vulnerability Scanner and SQLi Tool User-Agents
id: 3f6a1c52-8b7e-4d19-a2c3-5e9d7b410a01
status: experimental
description: Detects sqlmap, nikto, ffuf, gobuster, dirsearch, Acunetix and nmap NSE user-agents against web servers, as used by the BOSSAI AI-augmented attack mesh (TL-2026-5309).
references:
  - https://www.acronis.com/en/tru/posts/bossai-inside-the-ai-attack-mesh-that-targeted-taiwans-emergency-services/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1046
  - attack.tool.sqlmap
logsource:
  category: webserver
detection:
  selection:
    c-useragent|contains:
      - 'sqlmap'
      - 'nikto'
      - 'ffuf'
      - 'gobuster'
      - 'dirsearch'
      - 'acunetix'
      - 'wvs'
      - 'Nmap Scripting Engine'
  condition: selection
falsepositives:
  - Authorised vulnerability scanning and penetration tests
  - Internal DAST pipelines using Acunetix or ffuf
level: high

Known false positives:

• Authorised penetration tests and scheduled DAST scans from known scanner IPs
• Security vendors or bug-bounty researchers scanning the public site

Tuning notes: Allowlist scanner source IPs and test windows. Raise the requests threshold on high-traffic sites. Scanner user-agents are trivially spoofed, so keep the SQLi payload branch. Pivot on matching client IPs against the BOSSAI infrastructure IOC detection (SPL-003) to raise priority.

• 🔒 BOSSAI Hikvision Exploitation Tool RCE Requests and Web Shell Upload · unlock with TL Creds
• 🔒 BOSSAI Offensive Toolchain Execution on Linux (sqlmap, Hydra, ffuf, gobuster, dirsearch, Metasploit, Hermes agent flags) · unlock with TL Creds
• 🔒 BOSSAI autossh Multi-Port Tunnel to GPU Infrastructure ([indicator]) · unlock with TL Creds
• 🔒 BOSSAI SQL Injection Payload Burst (Boolean-Blind, Union, Time-Based, Oracle Error-Based) · unlock with TL Creds
• 🔒 BOSSAI Agent Playbook and Operator Script Artifacts on Linux Hosts · unlock with TL Creds
• 🔒 BOSSAI Operator Domain DNS Resolution · unlock with TL Creds
• 🔒 BOSSAI XML-RPC and Login Endpoint Credential Stuffing / Hydra Brute Force · unlock with TL Creds
• 🔒 BOSSAI Infrastructure IOC Match in Network, DNS and Proxy Logs · unlock with TL Creds

Indicators of compromise for BOSSAI AI agent mesh

As of 2026-11-05, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5309.

Sample indicators (3 of 29)

• IP address: 112.121.185[.]218
• Domain: vps[.]xs1[.]ccwu[.]cc
• IP address: 156.240.109[.]26

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How BOSSAI AI agent mesh works

Acronis Threat Research Unit (TRU) published an analysis on 2026-11-04 of an exposed, misconfigured development environment (90,000+ files, ~9GB of agent conversations, command histories and victim data) belonging to a lone operator. TRU classifies the activity as an AI-augmented threat (AAT) and assesses with high confidence that one person in Hualien City, Taiwan ran the operation. Taiwan's Ministry of Digital Affairs reportedly detected AI-assisted attacks on government agencies from 2026-07-20 and set up a task force. TRU observed the mesh for a 12-day window and saw confirmed unauthorized access at roughly 10 targets across three countries.

The mesh comprised 12 configured agents, 9 active: Hermes (primary offensive agent, ~95 sessions, 18,311 messages, 83.5% direct tool calls and results, 3,300+ terminal commands, 2,000 code-execution calls, 500 file writes), HalberdStrike (PenTestGPT-fork assessment harness), Cursor, Trae, CyberStrike, Grok, Claude Code, Codex and OpenClaw. Hermes cycled through at least 9 models over 19 days before settling on an abliterated DeepSeek-V4 variant (64K context) on local GPUs; a GPU cluster in Guangzhou (cn-4090, 192GB VRAM) was tunneled to the primary VPS via autossh over 8 ports. Commercial models used for infrastructure work (Grok 4.5, MiniMax M3) refused malicious requests and demanded written authorization (MiniMax M3 cited the Thai Computer Crime Act); a 'Developer Mode' jailbreak against Grok failed. The Hermes system prompt instructed full autonomy and no refusals, and ran with HERMES_YOLO_MODE=1 and HERMES_ACCEPT_HOOKS=1. Up to 13 MCP servers exposed GitHub scanning, CVE lookup, OSINT, cloud auditing, Ghidra, Radare2, Playwright, a Kali wrapper (nmap, sqlmap, Metasploit, Hydra) and HexStrike AI; three (HexStrike AI, Kali MCP, Ghidra bridge) remained active. Reusable SKILL.md playbooks (gov-api-penetration with 51 uses, gambling-platform-penetration with 28 uses, awvs-llm-analyzer, auto_exploit_pipeline) gave the agents persistent offensive memory.

Reconnaissance used FOFA (432 queries), Shodan (213), nmap (271 messages), nikto, ffuf, gobuster, dirsearch and a cracked Acunetix build. Exploitation relied on sqlmap (561 messages, boolean-based blind SQLi), Hydra brute-forcing, XML-RPC credential stuffing (2,600+ combinations), default credentials, unauthenticated APIs and a C# Hikvision exploitation tool v1.3 (RCE via keepAlive, applyCT and applyAutoLoginTicket, file upload for web shells, CmdShell). On 2026-07-25 the operator asked Grok to port the Hikvision tool to Linux and was refused. Egress used a SOCKS5 pool and BrightData datacenter proxies for geo-located exit nodes. A representative chain against a Thai university: subdomain enumeration (50+), parallel scanning, SQLi on a legacy Oracle 9.2.0.4.0 host, database user and 2,563-row administrator table extraction, then a student-record dump through a Thai-geolocated proxy. The operator manually pasted output between agents (HalberdStrike report, Hermes consolidation, Cursor exploitation).

The operator's nine-VPS fleet included vps12 (primary platform), vps5 (Hikvision tool), vps6 (IKEv2/L2TP VPN) and vps9 (SMTP/IMAP/POP3 mail stack, Vesta); agent command channels ran through WeChat (Hermes) and LINE (OpenClaw) gateways. Attribution indicators include the handles bossjy, lstjks and TIAN0517 (GitHub), an SSH identity in vps12 authorized_keys, residential broadband in Hualien, and small-business fronts (99 Gas Store, SnapPost, ShinSoft, INCELLDERM reseller).

Confirmed Taiwan impact: Taipei fire-department patient-care platform (ECG readings, ambulance video, vital signs from 2018) and the city 119 dispatch system (incident times, response types, street-level locations across seven districts); an emergency-management system with a hardcoded AES-256 key in frontend JavaScript; a fire-dispatch vendor with default root database credentials (18+ tables); a lending firm with 16 SQLi points on MSSQL 2017; and a mobile-payment provider with a CVV validation bypass. Other victims: three Thai universities with confirmed SQLi exfiltration (489 targets identified across 45 institutions), ~206,800 Mexican residential phone records plus ~124,000 directory records, and reconnaissance of a Honduran air-force personnel system (API endpoints mapped, not exploited).

The campaign was low-sophistication: Acronis notes victims were weakly protected before any AI was involved (unpatched legacy systems, medical-data ports open since 2018, unauthenticated APIs, unpatched Oracle). Over 50% of HalberdStrike's high/critical findings were false positives and some models fabricated CVEs. No CVEs are attributed by the primary sources; the activity used known weaknesses, not zero-days.

MITRE ATT&CK techniques by tactic:

Exfiltration

T1020 Automated Exfiltration

Lateral Movement

T1021.004 SSH

Discovery

T1046 Network Service Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1090.002 External Proxy

Credential Access

T1110.001 Password Guessing; T1110.004 Credential Stuffing

Collection

T1119 Automated Collection

Persistence

T1505.003 Web Shell

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1588.002 Tool; T1588.007 Artificial Intelligence

Reconnaissance

T1589 Gather Victim Identity Information; T1590.002 DNS; T1592 Gather Victim Host Information; T1595.002 Vulnerability Scanning; T1596.005 Scan Databases

Remediation for BOSSAI AI agent mesh

Patches

• Patch internet-facing applications and Hikvision devices exposed to the keepAlive/applyCT/applyAutoLoginTicket RCE functions

Immediate actions

• Block and hunt for the listed IPs and domains in network and DNS logs
• Require authentication on all public-facing APIs, especially emergency and health-data services
• Rotate default credentials (for example default root database accounts) and remove hardcoded keys from frontend JavaScript
• Close unused ports, including medical-data ports exposed since 2018

Workarounds

• Place legacy and IoT systems behind VPN or allowlisted access until patched

Longer-term hardening

• Retire or isolate unpatched legacy systems such as Oracle 9.2.0.4.0
• Remediate SQL injection with parameterized queries and WAF rules
• Monitor for rapid automated scanning patterns (nmap, nikto, ffuf, gobuster, dirsearch, sqlmap user agents)
• Alert on credential-stuffing bursts against XML-RPC and login endpoints
• Limit AI agent tool permissions and require human approval for autonomous actions in defender-side agent deployments

Affected and fixed versions

• Oracle — Oracle Database
  Vulnerable versions: 9.2.0.4.0 (legacy, unpatched)
• Microsoft — SQL Server (lending firm, 16 SQLi points)
  Vulnerable versions: 2017 (per Acronis, application-level SQLi)
• Hikvision — Hikvision devices (targeted by Comprehensive Vulnerability Exploitation Tool v1.3)
  Vulnerable versions: unspecified
• Various — Taiwanese emergency-dispatch, patient-care and financial web applications; Thai university web portals
  Vulnerable versions: unspecified

Timeline of BOSSAI AI agent mesh

• 2018-01-01 Medical and dispatch data later exfiltrated dates back to 2018 (year-level precision only); medical-data ports had been open since 2018 per Acronis.
• 2026-07-20 Taiwan's Ministry of Digital Affairs reportedly detected initial AI-assisted attacks on government agencies and later formed an AI threat task force.
• 2026-07-25 Operator asked the Grok agent to port the Hikvision exploitation tool to Linux; Grok refused, per Acronis TRU logs.
• 2026-08-01 A separate AI-driven intrusion was reported in August 2026 (month-level precision, per GBHackers).
• 2026-11-04 eSecurity Planet reported roughly 10 confirmed compromised targets across three countries and organizations in 11 countries in total.
• 2026-11-04 Acronis TRU published its analysis of the BOSSAI mesh from an exposed development environment (90,000+ files, ~9GB), covering a 12-day observed activity window.
• 2026-11-05 GBHackers and other outlets reported the campaign, including Taipei fire-department patient-care and 119 dispatch data exposure.

Sources cited for BOSSAI AI agent mesh

• BOSSAI: Inside the AI attack mesh that targeted Taiwan's emergency services (Acronis TRU) acronis.com · Research · 2026-11-04
• AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Dispatch Data in Taiwan (GBHackers) gbhackers.com · News · 2026-11-05
• One Hacker Used 12 AI Agents to Target Taiwan's Emergency Services (eSecurity Planet) esecurityplanet.com · News · 2026-11-04
• Hacker Deploys BOSSAI Network of 12 AI Agents to Target Hundreds of Organizations Worldwide (CyberPress) cyberpress.org · News
• BOSSAI, un solo attaccante e una rete di agenti AI contro centinaia di organizzazioni (Bitmat) bitmat.it · News

More in threat intel

• Praetorian Brutus: Open-Source Multi-Protocol Credential Testing Engine Expands to 14 New Protocols with People Enumeration and Credential Persistence
• ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)
• OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
• OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks
• Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)