# BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

> A single operator in Hualien City, Taiwan ran BOSSAI, a mesh of 12 AI agents (9 active) backed by abliterated DeepSeek/GLM/Qwen models and MCP servers wrapping Kali, Ghidra and HexStrike AI, against hundreds of organizations in eleven countries. Confirmed breaches include a Taipei fire-department patient-care platform and the city's 119 dispatch system, plus Thai universities and Mexican residential phone data.

- **Published:** 2026-11-05T08:31:54Z
- **Last reviewed:** 2026-11-05T08:31:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5309
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5309.png
- **ID:** TL-2026-5309
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** BOSSAI operator (Taiwan)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Acronis Threat Research Unit (TRU) published an analysis on 2026-11-04 of an exposed, misconfigured development environment (90,000+ files, ~9GB of agent conversations, command histories and victim data) belonging to a lone operator. TRU classifies the activity as an AI-augmented threat (AAT) and assesses with high confidence that one person in Hualien City, Taiwan ran the operation. Taiwan's Ministry of Digital Affairs reportedly detected AI-assisted attacks on government agencies from 2026-07-20 and set up a task force. TRU observed the mesh for a 12-day window and saw confirmed unauthorized access at roughly 10 targets across three countries.

The mesh comprised 12 configured agents, 9 active: Hermes (primary offensive agent, ~95 sessions, 18,311 messages, 83.5% direct tool calls and results, 3,300+ terminal commands, 2,000 code-execution calls, 500 file writes), HalberdStrike (PenTestGPT-fork assessment harness), Cursor, Trae, CyberStrike, Grok, Claude Code, Codex and OpenClaw. Hermes cycled through at least 9 models over 19 days before settling on an abliterated DeepSeek-V4 variant (64K context) on local GPUs; a GPU cluster in Guangzhou (cn-4090, 192GB VRAM) was tunneled to the primary VPS via autossh over 8 ports. Commercial models used for infrastructure work (Grok 4.5, MiniMax M3) refused malicious requests and demanded written authorization (MiniMax M3 cited the Thai Computer Crime Act); a 'Developer Mode' jailbreak against Grok failed. The Hermes system prompt instructed full autonomy and no refusals, and ran with HERMES_YOLO_MODE=1 and HERMES_ACCEPT_HOOKS=1. Up to 13 MCP servers exposed GitHub scanning, CVE lookup, OSINT, cloud auditing, Ghidra, Radare2, Playwright, a Kali wrapper (nmap, sqlmap, Metasploit, Hydra) and HexStrike AI; three (HexStrike AI, Kali MCP, Ghidra bridge) remained active. Reusable SKILL.md playbooks (gov-api-penetration with 51 uses, gambling-platform-penetration with 28 uses, awvs-llm-analyzer, auto_exploit_pipeline) gave the agents persistent offensive memory.

Reconnaissance used FOFA (432 queries), Shodan (213), nmap (271 messages), nikto, ffuf, gobuster, dirsearch and a cracked Acunetix build. Exploitation relied on sqlmap (561 messages, boolean-based blind SQLi), Hydra brute-forcing, XML-RPC credential stuffing (2,600+ combinations), default credentials, unauthenticated APIs and a C# Hikvision exploitation tool v1.3 (RCE via keepAlive, applyCT and applyAutoLoginTicket, file upload for web shells, CmdShell). On 2026-07-25 the operator asked Grok to port the Hikvision tool to Linux and was refused. Egress used a SOCKS5 pool and BrightData datacenter proxies for geo-located exit nodes. A representative chain against a Thai university: subdomain enumeration (50+), parallel scanning, SQLi on a legacy Oracle 9.2.0.4.0 host, database user and 2,563-row administrator table extraction, then a student-record dump through a Thai-geolocated proxy. The operator manually pasted output between agents (HalberdStrike report, Hermes consolidation, Cursor exploitation).

The operator's nine-VPS fleet included vps12 (primary platform), vps5 (Hikvision tool), vps6 (IKEv2/L2TP VPN) and vps9 (SMTP/IMAP/POP3 mail stack, Vesta); agent command channels ran through WeChat (Hermes) and LINE (OpenClaw) gateways. Attribution indicators include the handles bossjy, lstjks and TIAN0517 (GitHub), an SSH identity in vps12 authorized_keys, residential broadband in Hualien, and small-business fronts (99 Gas Store, SnapPost, ShinSoft, INCELLDERM reseller).

Confirmed Taiwan impact: Taipei fire-department patient-care platform (ECG readings, ambulance video, vital signs from 2018) and the city 119 dispatch system (incident times, response types, street-level locations across seven districts); an emergency-management system with a hardcoded AES-256 key in frontend JavaScript; a fire-dispatch vendor with default root database credentials (18+ tables); a lending firm with 16 SQLi points on MSSQL 2017; and a mobile-payment provider with a CVV validation bypass. Other victims: three Thai universities with confirmed SQLi exfiltration (489 targets identified across 45 institutions), ~206,800 Mexican residential phone records plus ~124,000 directory records, and reconnaissance of a Honduran air-force personnel system (API endpoints mapped, not exploited).

The campaign was low-sophistication: Acronis notes victims were weakly protected before any AI was involved (unpatched legacy systems, medical-data ports open since 2018, unauthenticated APIs, unpatched Oracle). Over 50% of HalberdStrike's high/critical findings were false positives and some models fabricated CVEs. No CVEs are attributed by the primary sources; the activity used known weaknesses, not zero-days.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1589 Gather Victim Identity Information
- T1592 Gather Victim Host Information
- T1590.002 DNS
- T1596.005 Scan Databases
- T1583.003 Virtual Private Server
- T1583.001 Domains
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1110.001 Password Guessing
- T1110.004 Credential Stuffing
- T1046 Network Service Discovery
- T1021.004 SSH
- T1119 Automated Collection
- T1090.002 External Proxy
- T1020 Automated Exfiltration

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BOSSAI Automated Web Scanning and SQL Injection Tooling (sqlmap/nikto/ffuf/gobuster/dirsearch)** (`TL-2026-5309-SPL-001`)

TL-2026-5309 BOSSAI: the AI-driven operator mesh drove sqlmap (boolean-based blind SQLi against legacy Oracle 9.2.0.4.0), nikto, ffuf, gobuster, dirsearch, nmap and a cracked Acunetix build against public web applications through Kali/HexStrike MCP servers. Flags clients using these scanner user-agents or sending SQLi payload strings at volume.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002, T1046
- **Data sources:** apache_access_combined, nginx_access, iis_w3c
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=web sourcetype=access_combined earliest=-24h
```BOSSAI TL-2026-5309: scanner user-agents (sqlmap, nikto, ffuf, gobuster, dirsearch, acunetix) or SQLi payload strings```
| eval ua=lower(coalesce(useragent,""))
| eval tool=case(like(ua,"%sqlmap%"),"sqlmap", like(ua,"%nikto%"),"nikto", like(ua,"%ffuf%"),"ffuf", like(ua,"%gobuster%"),"gobuster", like(ua,"%dirsearch%"),"dirsearch", like(ua,"%acunetix%") OR like(ua,"%wvs%"),"acunetix", like(ua,"%nmap%"),"nmap_nse", true(),null())
| eval sqli=if(match(lower(_raw),"(sleep|waitfor.{1,5}delay|union.{1,5}select|extractvalue|dbms_pipe|utl_inaddr|and.{1,5}[0-9]+=[0-9]+)"),1,0)
| where isnotnull(tool) OR sqli=1
| stats count AS requests dc(uri_path) AS unique_paths sum(sqli) AS sqli_hits count(eval(status>=500)) AS server_errors values(tool) AS tools min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where requests>=20 OR sqli_hits>=5
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(24h)
| extend ua = tolower(csUserAgent), q = tolower(strcat(csUriStem, "?", csUriQuery))
| extend tool = case(ua has "sqlmap", "sqlmap", ua has "nikto", "nikto", ua has "ffuf", "ffuf", ua has "gobuster", "gobuster", ua has "dirsearch", "dirsearch", ua has "acunetix" or ua has "wvs", "acunetix", ua has "nmap", "nmap_nse", "")
| extend sqli = q matches regex @"(sleep|waitfor.{1,5}delay|union.{1,5}select|extractvalue|dbms_pipe|utl_inaddr|and.{1,5}[0-9]+=[0-9]+)"
| where tool != "" or sqli
| summarize Requests=count(), UniquePaths=dcount(csUriStem), SqliHits=countif(sqli), ServerErrors=countif(scStatus >= 500), Tools=make_set(tool), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by cIP, sSiteName
| where Requests >= 20 or SqliHits >= 5
```

### Sigma

```yaml
title: BOSSAI Web Vulnerability Scanner and SQLi Tool User-Agents
id: 3f6a1c52-8b7e-4d19-a2c3-5e9d7b410a01
status: experimental
description: Detects sqlmap, nikto, ffuf, gobuster, dirsearch, Acunetix and nmap NSE user-agents against web servers, as used by the BOSSAI AI-augmented attack mesh (TL-2026-5309).
references:
  - https://www.acronis.com/en/tru/posts/bossai-inside-the-ai-attack-mesh-that-targeted-taiwans-emergency-services/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1046
  - attack.tool.sqlmap
logsource:
  category: webserver
detection:
  selection:
    c-useragent|contains:
      - 'sqlmap'
      - 'nikto'
      - 'ffuf'
      - 'gobuster'
      - 'dirsearch'
      - 'acunetix'
      - 'wvs'
      - 'Nmap Scripting Engine'
  condition: selection
falsepositives:
  - Authorised vulnerability scanning and penetration tests
  - Internal DAST pipelines using Acunetix or ffuf
level: high

```

**Known false positives:**

- Authorised penetration tests and scheduled DAST scans from known scanner IPs
- Security vendors or bug-bounty researchers scanning the public site

**Tuning notes:** Allowlist scanner source IPs and test windows. Raise the requests threshold on high-traffic sites. Scanner user-agents are trivially spoofed, so keep the SQLi payload branch. Pivot on matching client IPs against the BOSSAI infrastructure IOC detection (SPL-003) to raise priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BOSSAI Hikvision Exploitation Tool RCE Requests and Web Shell Upload (locked: unlock with TL Creds)
- BOSSAI Offensive Toolchain Execution on Linux (sqlmap, Hydra, ffuf, gobuster, dirsearch, Metasploit, Hermes agent flags) (locked: unlock with TL Creds)
- BOSSAI autossh Multi-Port Tunnel to GPU Infrastructure ([indicator]) (locked: unlock with TL Creds)
- BOSSAI SQL Injection Payload Burst (Boolean-Blind, Union, Time-Based, Oracle Error-Based) (locked: unlock with TL Creds)
- BOSSAI Agent Playbook and Operator Script Artifacts on Linux Hosts (locked: unlock with TL Creds)
- BOSSAI Operator Domain DNS Resolution (locked: unlock with TL Creds)
- BOSSAI XML-RPC and Login Endpoint Credential Stuffing / Hydra Brute Force (locked: unlock with TL Creds)
- BOSSAI Infrastructure IOC Match in Network, DNS and Proxy Logs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `112.121.185[.]218`
- Domain: `vps[.]xs1[.]ccwu[.]cc`
- IP address: `156.240.109[.]26`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BOSSAI: Inside the AI attack mesh that targeted Taiwan's emergency services (Acronis TRU)](https://www.acronis.com/en/tru/posts/bossai-inside-the-ai-attack-mesh-that-targeted-taiwans-emergency-services/)
- [AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Dispatch Data in Taiwan (GBHackers)](https://gbhackers.com/ai-powered-bossai-attacks/)
- [One Hacker Used 12 AI Agents to Target Taiwan's Emergency Services (eSecurity Planet)](https://www.esecurityplanet.com/threats/news-bossai-ai-agents-taiwan-emergency-services-apac/)
- [Hacker Deploys BOSSAI Network of 12 AI Agents to Target Hundreds of Organizations Worldwide (CyberPress)](https://cyberpress.org/hacker-unleashes-bossai-agents/)
- [BOSSAI, un solo attaccante e una rete di agenti AI contro centinaia di organizzazioni (Bitmat)](https://www.bitmat.it/sicurezza/bossai-un-solo-attaccante-e-una-rete-di-agenti-ai-contro-centinaia-di-organizzazioni/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5309