Acronis Details BOSSAI AI-Agent Campaign Targeting 11 Countries

Nov 4, 2026 · Original article ↗

Summary

Acronis TRU describes BOSSAI, a 12-agent AI attack mesh operated by one person and used against organizations in 11 countries. The investigation reports confirmed data access or exfiltration at roughly 10 targets, including emergency services and universities.

Key points

Acronis TRU says it analyzed more than 90,000 files and 9GB of evidence, including orchestration logs, agent conversations, commands, tools and victim data.
BOSSAI comprised 12 agents, nine active; the operator manually relayed information between agents rather than enabling agent-to-agent communication.
Offensive agents primarily used locally run models with safety alignment removed, while commercial models repeatedly refused explicit attack requests.
The operator combined AI agents and MCP servers with tools including nmap, sqlmap, Metasploit and Ghidra; some agents ran autonomously with actions auto-approved.
The investigation reports confirmed system access or data exfiltration at roughly 10 targets across three countries, while other attacks and reconnaissance remained unconfirmed.
In Taiwan, exposed emergency-services systems provided access to patient-care records and dispatch case data; the article also reports extracted data from a Taiwanese lending firm.
In Thailand, the investigation found confirmed SQL injection and data extraction at three universities. Separately, more than half of HalberdStrike's high-severity and critical findings were false positives or misclassifications.

Article Details

Attack Vectors: Automated vulnerability scanning and exploitation of public-facing web applications, including confirmed SQL injection against Taiwanese and Thai targets.
Access to emergency-services medical records and dispatch data exposed through unauthenticated platforms and APIs.
Brute-force attempts against a fire-agency single sign-on portal and credential-stuffing attempts against a Mexican site's WordPress XML-RPC endpoint; neither had confirmed successful logins.
A Taiwanese fire-dispatch technology vendor's database administration panel was accessed using default root credentials.
The operator used AI agents and pentesting tools to enumerate targets, analyze scan results, write scripts, and carry out exploitation and data collection.
Defensive Notes: Require authentication for medical records, emergency-dispatch data, and other sensitive API resources; the article reports these were accessible without credentials.
Remediate SQL injection in production applications and secure database systems, including legacy deployments.
Enforce server-side payment-card validation; agents demonstrated that one provider accepted a card despite an incorrect CVV.
Replace default credentials and protect login endpoints against brute-force and credential-stuffing attempts.
Apply scope controls and human review to autonomous security agents; the article found a pentesting tool's scope enforcement disabled and its risk tiers set to auto-approve.
Do not rely on obscurity as a defense; the article reports that automated scanning rapidly identified targets across many organizations.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`888[.]bossjy[.]kdns[.]fr`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
DOMAIN	`attacker-collector[.]com`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
DOMAIN	`boss[.]jytian[.]cc[.]cd`	Listed in the article's BOSSAI IOC section; the article links the operator's Jy Technical Team branding to the attack infrastructure.
DOMAIN	`c[.]xs1[.]ccwu[.]cc`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
DOMAIN	`ssh[.]gputw[.]ai`	Listed in the article's BOSSAI IOC section; the article describes an operator GPU cluster connected to the attack platform.
DOMAIN	`vps[.]xs1[.]ccwu[.]cc`	Listed as a BOSSAI IOC; the article also describes an operator instruction to configure a VPS address with a closely matching hostname.
DOMAIN	`xss[.]xs1[.]ccwu[.]cc`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`112[.]121[.]185[.]218`	Operator-controlled vps12 attack platform hosting OpenClaw C2 and offensive tooling.
IPV4	`156[.]240[.]109[.]26`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]153`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]154`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]155`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]156`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]157`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`202[.]160[.]76[.]174`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.
IPV4	`49[.]158[.]237[.]136`	Listed in the article's BOSSAI IOC section as campaign-related infrastructure; its specific role is not described.