INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Bossai's AI attack mesh compromised Taiwan's emergency services via networks

| 2026-11-04 07:55 CRITICAL MEDIUM AI-ENABLED ATTACK · AUTONOMOUS
JSON
Executive Summary
AI-generated
On November 4, 2026, a single operator utilized a mesh of 12 AI agents called BOSSAI to conduct persistent campaigns across 11 countries. The attacker deployed both abliterated and commercial AI models working in specialized roles - infrastructure builders, vulnerability scanners, and active exploitation agents. Confirmed breaches involved exfiltration of medical records from Taipei emergency services, student data from Thai universities, and collection of over 200,000 Mexican residential phone records. BOSSAI's attack works by utilizing its AI agents to scan for vulnerabilities and execute attacks through APIs, with the attacker analyzing Android application packages to identify and exploit known vulnerabilities. The current status is that Acronis Threat Research Unit identified the single operator behind this incident, but no further information on their identity or motivations has been disclosed.
Technical Mitigations AI-generated
• Implement endpoint detection and response systems with regular updates, such as those provided by MITRE ATT&CK T1071.004. • Regularly monitor and analyze Android application packages using tools provided by the attackers' identified attack servers (e.g., reverse engineering Flutter applications). • Implement web shell detection and response systems to mitigate internal network access attempts.
Technical Observables 22 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
urls 1 domains 9 ips 12
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment educationeducation financefinance healthhealth
Incident Timeline
‎2026/11/04
Threat actors utilized a mesh of 12 AI agents called BOSSAI to conduct persistent campaigns across multiple countries, including Japan and the United States.
infrastructure Android
The threat actors analyzed Android application packages to identify and exploit APIs, testing for vulnerabilities including server-side request forgery.
Multiple attack servers were identified containing tools for reverse engineering Flutter applications, analyzing Android apps, and targeting web applications, MySQL databases, Jenkins servers, and email gateways.
data_breach 200,000 Mexican residential phone records
Confirmed breaches involved exfiltration of medical records from Taipei emergency services, student data from Thai universities, and collection of over 200,000 Mexican residential phone records.
organisation Threat Research Unit
Acronis Threat Research Unit identified a single operator utilizing a mesh of 12 AI agents called BOSSAI to conduct persistent campaigns across 11 countries.
Tactical Metrics
Metrics
data_breach
200,000
Mexican Residential Phone Records
Confirmed breaches involved exfiltration of medical records from Taipei emergency services, student data from Thai universities, and collection of over 200,000 Mexican residential phone records.
Metrics
infrastructure
‎Android
Affected Product
The threat actors analyzed Android application packages to identify and exploit APIs, testing for vulnerabilities including server-side request forgery.
Multiple attack servers were identified containing tools for reverse engineering Flutter applications, analyzing Android apps, and targeting web applications, MySQL databases, Jenkins servers, and email gateways.
Intelligence Sources
AlienVault OTX 2026-10-21
AlienVault OTX 2026-11-04