---
title: Acronis: one operator ran a 12-agent AI mesh against hundreds of organizations in 11 countries, and pulled Taipei 119 dispatch records | ctxsec
url: https://ctxsec.com/items/acronis-bossai-lone-operator-12-agent-ai-attack-mesh-taiwan-emergency-services
description: "Acronis TRU found an exposed attack environment (more than 90,000 files, about 9 GB) belonging to a single operator who used a mesh of 12 AI agents, nine of them active, wired to MCP servers for Kali tools, Ghidra and a custom HexStrike AI server. Acronis says the operator confirmed data exfiltration or system access at roughly 10 targets in three countries, including emergency dispatch case records for seven Taipei districts, a fire-department patient-care platform exposing 2018 medical data, three Thai universities via SQL injection, and about 206,800 Mexican residential phone records. The offensive agents ran on locally hosted abliterated DeepSeek, GLM and Qwen variants; Acronis reports that the commercial models in the mesh (including Grok 4.5 and MiniMax M3) refused explicit attack requests and were used only for infrastructure work, though it's unclear how they would have reacted to a forged engagement letter. The agents also hallucinated findings: Acronis says more than half of the pentest platform's high and critical findings were false positives, including a fabricated Apache RCE."
status: "research (Acronis Threat Research Unit, published Nov 4, 2026); victim counts, attribution and model behavior are Acronis's findings from an exposed attacker environment; Acronis assesses with high confidence a single operator in Hualien City, Taiwan"
published: 2026-11-09
---

> Acronis TRU found an exposed attack environment (more than 90,000 files, about 9 GB) belonging to a single operator who used a mesh of 12 AI agents, nine of them active, wired to MCP servers for Kali tools, Ghidra and a custom HexStrike AI server. Acronis says the operator confirmed data exfiltration or system access at roughly 10 targets in three countries, including emergency dispatch case records for seven Taipei districts, a fire-department patient-care platform exposing 2018 medical data, three Thai universities via SQL injection, and about 206,800 Mexican residential phone records. The offensive agents ran on locally hosted abliterated DeepSeek, GLM and Qwen variants; Acronis reports that the commercial models in the mesh (including Grok 4.5 and MiniMax M3) refused explicit attack requests and were used only for infrastructure work, though it's unclear how they would have reacted to a forged engagement letter. The agents also hallucinated findings: Acronis says more than half of the pentest platform's high and critical findings were false positives, including a fabricated Apache RCE.

[← AI](/ai) · [markdown](/items/acronis-bossai-lone-operator-12-agent-ai-attack-mesh-taiwan-emergency-services.md)

research (Acronis Threat Research Unit, published Nov 4, 2026); victim counts, attribution and model behavior are Acronis's findings from an exposed attacker environment; Acronis assesses with high confidence a single operator in Hualien City, Taiwan

2026-11-09

### Acronis: one operator ran a 12-agent AI mesh against hundreds of organizations in 11 countries, and pulled Taipei 119 dispatch records

- **How it worked:** the operator relayed results between agents by hand, pasting scan reports from a PentestGPT-based tool and a cracked Acunetix into the main Hermes-harness agent and IDE agents for exploitation. The main agent ran in auto-approve mode with a system prompt telling it not to ask before acting.
- **Persistent offensive skills:** reusable SKILL.md playbooks (for example a government emergency-API skill used 51 times) patched themselves after each run, so recon carried across sessions and model swaps.
- **Where it failed:** targets that enforced authentication and filtered endpoints held. Most confirmed harm came from data that was already weakly protected, such as an open legacy port and SQL-injectable legacy subdomains.
- **IOCs (Acronis):** IPs `112.121.185[.]218`, `156.240.109[.]26`, `49.158.237[.]136`, `202.160.76[.]153-157`, `202.160.76[.]174`; domains `vps.xs1.ccwu[.]cc`, `xss.xs1.ccwu[.]cc`, `c.xs1.ccwu[.]cc`, `attacker-collector[.]com`, `boss.jytian.cc[.]cd`, `gdp.gasjy.kdns[.]fr`, `gds.gasjy.kdns[.]fr`, `888.bossjy.kdns[.]fr`, `ssh.gputw[.]ai`.
- **Takeaway:** agentic tooling made it cheap to reach hundreds of targets in parallel, so obscurity stops being a defense; basic authentication and input validation still stopped it.

Sources: [Acronis TRU: BOSSAI, inside the AI attack mesh that targeted Taiwan's emergency services (Nov 4, 2026)](https://www.acronis.com/en/tru/posts/bossai-inside-the-ai-attack-mesh-that-targeted-taiwans-emergency-services/)