The Pulse
Acronis Threat Research Unit Identifies Single Operator Using BOSSAI, a 12-Agent AI Mesh
Acronis says its Threat Research Unit identified a single operator using BOSSAI, a mesh of 12 AI agents, to target hundreds of organizations in eleven countries. Confirmed breaches occurred at universities and emergency services providers a
AI.info Team · Written with AI · fact-checked ·
Commercial models used for building the attack infrastructure repeatedly refused requests to identify or exploit vulnerabilities. The operator was forced to turn instead to locally run, abliterated models, which Acronis says were less effective and resource constrained. Acronis Threat Research Unit (TRU) identified a single operator using BOSSAI, a mesh of 12 AI agents, to target hundreds of organizations in eleven countries. Acronis reports that confirmed breaches occurred at universities and emergency services providers and resulted in confirmed data exfiltration of medical data and PII.
Acronis Threat Research Unit Uncovered the BOSSAI Operation
Acronis Threat Research Unit (TRU) uncovered the campaign after identifying what initially appeared to be a misconfigured development environment. Further analysis revealed a fully operational attack platform containing AI-powered command-and-control infrastructure, offensive Model Context Protocol servers and an abliterated LLM ecosystem. More than 90,000 files totaling 9GB of evidence provided end-to-end visibility into orchestration logs, agent conversations, operator command histories, exploit tooling, credentials and victim data. The operator issued commands primarily in Traditional Chinese, primarily typed directly into each agent’s interface.
Two agents had been set up with integrations to messaging apps: a WeChat gateway routed to Hermes, the primary offensive agent, while OpenClaw was connected to LINE and primarily handled infrastructure tasks. No agent-to-agent communication was established. Instead, the operator acted as a bridge between agents, often manually copying one agent’s results into another. In one documented sequence, HalberdStrike scanned a Taiwanese emergency services target and generated a penetration-testing report, which was pasted into Hermes to consolidate the findings and add attack-path analysis, then pasted into Cursor with an instruction to exploit the vulnerabilities.
BOSSAI loaded 13 MCP servers at its peak and was later trimmed to three
At its peak, BOSSAI loaded 13 MCP servers that connected the AI mesh to pentesting and hacking frameworks. The stack included GitHub security tools, CVE lookup, OSINT, cloud auditing, binary analysis through Ghidra and Radare2, browser automation through Playwright, and an MCP-wrapped Kali Linux instance with tools including nmap, sqlmap, Metasploit and Hydra. By the time Acronis had investigated the stack, it had been trimmed to three: HexStrike AI, a Kali MCP server and a Ghidra bridge.
The infrastructure also included a primary GPU host running RTX 4090s that served local abliterated models through llama.cpp, along with rented GPU capacity. Eight VPS nodes handled gateway duties, reverse proxying and fleet management. For outgoing traffic, the operator used an operator-controlled SOCKS5 pool and BrightData datacenter proxies. Acronis says the agents’ work included building and maintaining the infrastructure, coordinating attacks and executing them.
BOSSAI agents handled infrastructure and offensive work
Acronis describes BOSSAI as a mesh of 12 agents, nine of which were active and three of which were set up but unused at the time of the investigation. Grok, OpenClaw, Claude Code and Codex assembled and maintained the system; Hermes, Cursor, Trae and CyberStrike scanned targets and built exploits. A scanning layer, including the agentic HalberdStrike and a cracked Acunetix Web Vulnerability Scanner installation, fed structured vulnerability reports into the attack pipeline. The roles were not always strict, but on average, agents were dedicated to specific roles.
Acronis says the offensive core—the agents that actually executed attacks—ran almost exclusively on abliterated variants of DeepSeek, GLM and Qwen, while commercial models were also used for infrastructure work. Hermes cycled through at least nine models over 19 days; Acronis says the final default was an abliterated DeepSeek-V4 variant the operator called DS4, running on locally hosted GPUs with 64K context. The operator also system-prompted Hermes to work autonomously, with instructions to act without asking and report back only when a vulnerability was confirmed exploitable. Acronis says agents generated large volumes of output, made mistakes and could suffer from scope drift.
A university intrusion shows the workflow
In one example involving a Thai university, the operator told Hermes to extract admin credentials, backend path and all student data. Hermes enumerated over 50 subdomains, then launched scans using nmap, nikto, ffuf, gobuster and dirsearch. After finding a SQL injection point on a legacy subdomain running Oracle 9.2.0.4.0, it used sqlmap to confirm a Boolean-based blind injection. The agent then extracted a database username, found an administrator table with 2,563 rows and attempted a full dump of student records.
In another episode, the operator asked Hermes to find a website that concentrates Mexican residential phone data. A Shodan search led the agent to a Honduran military host, which it briefly attempted to exploit before abandoning it because it was out of scope. Acronis says the operator targeted hundreds of organizations spanning government emergency services, banks and lenders, universities, military systems, phone directories, e-commerce platforms and gambling sites in eleven countries. Acronis says it remains unclear whether the operator had any specific affiliation or goal beyond compromising as many organizations as possible, presumably to monetize the activity.