AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Dispatch Data in Taiwan

BOSSAI, an agentic attack platform run by one operator that exposed emergency medical and dispatch data in Taipei.

The campaign targeted hundreds of organizations in eleven countries, including emergency services, banks, universities, military systems and e-commerce sites. Confirmed breaches hit universities and emergency providers, with medical data and PII exfiltrated.

A Taipei fire department patient-care records platform exposed ECG readings, ambulance video, and patient vital signs without credentials.

The data dated back to 2018. Agents also pulled case records from a city’s 119 dispatch system, covering incident times, response types, status fields and street-level locations across seven Taipei districts.

Acronis stresses these were API case records, not live ambulance tracking. Other reporting says the campaign also took student data from Thai universities and more than 200,000 Mexican residential phone records.

Attackers such as Hermes, Cursor, Trae and CyberStrike scanned targets and built exploits. At its peak the mesh loaded 13 Model Context Protocol servers exposing tools like nmap, sqlmap and Metasploit through Kali, plus Ghidra and CVE lookup.

The operator sat at the centre of the mesh and manually pasted output between agents. In one documented chain, HalberdStrike scanned an emergency-services target, Hermes consolidated the findings, and Cursor executed the exploit on the operator’s instruction. Hermes ran about 95 sessions and generated 18,311 messages.

Acronis Threat Research Unit (TRU) identified, BOSSAI is a mesh of 12 AI agents, nine active and three configured but unused. Builders such as Grok, OpenClaw, Claude Code and Codex maintained the infrastructure.

AI-Powered BOSSAI Attacks

In one case it enumerated more than 50 subdomains of a Thai university, confirmed a blind SQL injection on an Oracle 9.2.0.4.0 host and began dumping student records.

Commercial models repeatedly refused offensive work. Some demanded proof of legal authorization and cited computer-crime law.

The operator therefore ran “abliterated” models, which are open-weight models with safety alignment removed.

These were DeepSeek, GLM and Qwen variants hosted on local RTX 4090 GPUs. Hermes cycled through at least nine models in 19 days before settling on a DeepSeek-V4 variant the operator called DS4.

The system prompt also granted full autonomy and ran in auto-approve mode.

The approach had costs. Over half of HalberdStrike’s high and critical findings were false positives or misclassifications, and some models fabricated CVEs.

Agents given excessive autonomy also passed over a Honduran military host because they judged it out of scope.

TRU found the platform through what looked like a misconfigured development environment. It held more than 90,000 files totaling 9GB, including agent conversations, command histories and victim data.

TRU assesses with high confidence that a single individual in Hualien City, Taiwan, operated the infrastructure. It classifies the activity as an “AI-augmented threat,” a lone actor with APT-like reach but no clear political or financial objective.

A C# Windows Forms application supporting the full exploitation lifecycle of Hikvision surveillance cameras, including unauthorized device access, RCE through functions such as keepAlive, applyCT, and applyAutoLoginTicket.

BOSSAI is not Taiwan’s first AI-driven intrusion. In August, Taiwan’s Ministry of Digital Affairs said it had detected AI-assisted attacks on government agencies since July 20.

It described a hybrid of manual operations and AI agents such as OpenClaw. Israeli firm Dream attributed a separate campaign to suspected China-linked actors.

It reported that agents harvested 85 credentials and exfiltrated more than 2,564 personnel records. Taiwan has since set up a task force to tackle AI cyber threats.

Acronis notes that the exposed systems were weakly protected before any AI was involved.

They included a medical-data port left open since 2018, dispatch records on a public API, a bank with 16 SQL-injection points and unpatched Oracle databases.

Agents did not create these flaws, but they found and collected them faster and more systematically than a manual attacker could.

Defenders should close legacy exposures, authenticate public APIs and monitor for rapid, automated scanning.

IOCs

Type	Indicator
IP address	112.121.185.218
IP address	156.240.109.26
IP address	49.158.237.136
Domain	vps.xs1.ccwu.cc
Domain	xss.xs1.ccwu.cc
Domain	c.xs1.ccwu.cc

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.