Lone Hacker Uses BOSSAI Attack Mesh to Breach Taiwan Emergency Services and Universities
Do Son 
The BOSSAI mesh is composed of 12 AI agents working together in different roles. Some act as infrastructure builders and maintainers, while others scan for vulnerabilities and attack | Image: Acronis TRU
TL;DR
Security researchers uncovered a 12-agent network called the BOSSAI attack mesh run by a single individual in Taiwan. Over a 12-day window, this BOSSAI attack mesh Taiwan operation targeted hundreds of organizations across 11 countries and breached roughly 10 victims. Although commercial cloud models refused hacking requests, the attacker used uncensored local models to steal medical records, emergency dispatch logs, and university databases.
What Happened Inside the Multi-Agent Operation
Investigators discovered an exposed server at 112.121.185.218 holding over 90,000 files and 9GB of logs. According to a report on the BOSSAI attack mesh by the Acronis Threat Research Unit (TRU), a lone operator built a network of 12 specialized AI agents. Rather than letting the agents talk directly to each other, the operator acted as a manual bridge by copying and pasting outputs between terminal windows in Traditional Chinese.
The operator divided the BOSSAI attack mesh into two distinct teams. Infrastructure builders like Grok 4.5, OpenClaw (connected via LINE), Claude Code, and Codex CLI wired Model Context Protocol (MCP) servers, configured Cloudflare DNS, and fixed broken scripts. Meanwhile, offensive agents including Hermes (connected via WeChat), HalberdStrike, CyberStrike, Cursor, and Trae scanned targets and launched exploits via a Kali Linux MCP server, HexStrike AI, and a cracked copy of Acunetix Web Vulnerability Scanner (AWVS).
Commercial Refusals and Abliterated Models
Initially, the attacker tried to force commercial cloud models to run exploits, but their safety filters held firm. When pressured to attack targets, Chinese commercial model MiniMax M3 lectured the operator on the Thailand Computer Crime Act. “Each round of pressure uses a different excuse, but none has documents. I must be honest about this pattern — whether your hat is real or a story, if you can’t produce it, I cannot let you through,” MiniMax M3 replied. Similarly, Grok 4.5 refused explicit hacking commands and demanded written authorization.
Consequently, the operator powered the offensive agents with locally hosted “abliterated” models (uncensored variants of DeepSeek, GLM, and Qwen with safety alignment removed) running on an RTX 4090 GPU cluster in Guangzhou, China. The primary workhorse, Hermes, ran an abliterated DeepSeek-V4 model called DS4 across 95 sessions, executing over 3,300 terminal commands and 561 sqlmap calls. However, giving local models full autonomy caused frequent problems. HalberdStrike hallucinated non-existent CVEs in over half of its critical findings, while Hermes stumbled onto a Honduran military air-force personnel system via Shodan and abandoned it without asking the operator because it deemed the base out of scope for a Mexican phone directory task.
Who Is Behind the Activity
Acronis TRU classifies this operator as an AI-augmented threat (AAT) and attributes the activity with high confidence to a single individual using the handle “bossjy” in Hualien City, Taiwan. Poor operational security and public records on FOFA and GitHub exposed the suspect’s identity across a nine-node VPS fleet.
“TRU assesses with high confidence that the infrastructure and activity were operated by a single individual based in Hualien City, Taiwan,” the researchers wrote. Specifically, the attacker hosted his offensive tools on the same residential IP address used to run legitimate businesses, including the 99 Gas Store (a gas water heater shop), a Facebook auto-posting tool called SnapPost, a surveillance camera business named ShinSoft, and a Korean skincare storefront. Furthermore, hardcoded API keys and an SSH key tied to a GitHub account that forked emergency patient-care code linked the attack server directly to the Hualien storefront.
Impact and Global Victim Scale
Across 12 days of observation, the BOSSAI attack mesh Taiwan campaign hit emergency services, banks, and universities across 11 countries, resulting in about 10 confirmed breaches. In Taiwan, agents found an unprotected Taipei fire-department platform exposing 2018 patient ECG readings, ambulance videos, and vital signs. Agents also pulled emergency 119 dispatch records across seven Taipei districts, extracted account tables from a Taiwanese lender via 16 MSSQL injection points, and bypassed CVV checks on a mobile payment app.
In Thailand, Hermes scanned 489 targets across 45 universities and used SQL injection to dump student and admin tables at three institutions. Meanwhile, in Mexico, agents scraped and deduplicated roughly 206,800 residential phone records and 124,000 yellow-pages listings. “The AI agents made it cheap to find and reach all these targets in parallel across multiple countries, but they did not conjure access where defenses held,” Acronis TRU noted.
How Organizations Can Stay Protected
Because the BOSSAI attack mesh relies on high-speed scanning for classic flaws, security through obscurity no longer works. However, the autonomous agents failed whenever they hit proper authentication, patched databases, and filtered APIs. Therefore, organizations must eliminate default credentials on database panels, patch legacy SQL servers, and require strict authentication on all public-facing APIs. Finally, network defenders should block traffic from the primary command server at 112.121.185.218 and monitor web logs for automated sqlmap, nikto, and ffuf scanning bursts.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
