Skip to content
NewA calmer, faster ZeroHour
Threat actorhighExploited in the wild

Hacker deploys 12 AI agents for Taiwan cyber attacks

Original title: One Hacker Uses 12 AI Agents to Breach Taiwan’s Emergency Services and Steal Sensitive Data

Cyber Security Newsby Tushar Subhra Dutta ()4 min read3 · 1 read
Read at cybersecuritynews.com
Part of a story covered by 3 sourcesOne Taiwan operator’s BOSSAI agents confirmed at about 10 targetsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

One operator in Taiwan used 12 AI agents to breach emergency services in Taiwan and steal medical data from hundreds of organizations across 11 countries.

A single operator in Taiwan built a team of 12 AI agents, named BOSSAI, to attack hundreds of organizations in 11 countries. The campaign targeted emergency services, banks, universities, and military systems. It led to confirmed theft of medical data and personal records. The agents handled roles like code writing, website scanning, and exploits. The operator managed the mesh from a base server. Acronis Threat Research Unit identified the campaign via a misconfigured development server containing logs and victim data. Commercial AI models refused to assist, leading to use of stripped safety models.

Unconfirmed: Attribution to single operator is based on reused branding and IPs

Key facts
  • 12 AI agents in BOSSAI mesh
  • Targeted Taiwan emergency services
  • Theft of medical and personal records
  • Attacks in 11 countries
  • Operator in Hualien City, Taiwan
Security assessment · AI, from the articleExploited in the wild

Impact: theft of medical and personal records

What to do
  1. 1.Patch exposed databases
  2. 2.Remove default credentials
  3. 3.Close old ports
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ai-agentscyber-espionagetaiwan
Victims
Taiwan emergency services
Organizations
Acronis
Countries
Taiwan
AI models
GrokClaudeCodex

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domain888.bossjy.kdns.frp[.]gasjy[.]kdns[.]fr Domain gds[.]gasjy[.]kdns[.]fr Domain 888[.]bossjy[.]kdns[.]fr Domain ssh[.]gputw[.]ai Note: IP addresses and domain
domainattacker-collector.comain xss[.]xs1[.]ccwu[.]cc Domain c[.]xs1[.]ccwu[.]cc Domain attacker-collector[.]com Domain boss[.]jytian[.]cc[.]cd Domain gdp[.]gasjy[.]kdns[
domainboss.jytian.cc.cdc[.]xs1[.]ccwu[.]cc Domain attacker-collector[.]com Domain boss[.]jytian[.]cc[.]cd Domain gdp[.]gasjy[.]kdns[.]fr Domain gds[.]gasjy[.]k
domainc.xs1.ccwu.ccn vps[.]xs1[.]ccwu[.]cc Domain xss[.]xs1[.]ccwu[.]cc Domain c[.]xs1[.]ccwu[.]cc Domain attacker-collector[.]com Domain boss[.]jytian[
domaingdp.gasjy.kdns.fracker-collector[.]com Domain boss[.]jytian[.]cc[.]cd Domain gdp[.]gasjy[.]kdns[.]fr Domain gds[.]gasjy[.]kdns[.]fr Domain 888[.]bossjy[.]
domaingds.gasjy.kdns.frss[.]jytian[.]cc[.]cd Domain gdp[.]gasjy[.]kdns[.]fr Domain gds[.]gasjy[.]kdns[.]fr Domain 888[.]bossjy[.]kdns[.]fr Domain ssh[.]gputw[.]
domainssh.gputw.ai[.]gasjy[.]kdns[.]fr Domain 888[.]bossjy[.]kdns[.]fr Domain ssh[.]gputw[.]ai Note: IP addresses and domains are intentionally Qdefan
domainvps.xs1.ccwu.cc]156 IP 202[.]160[.]76[.]157 IP 202[.]160[.]76[.]174 Domain vps[.]xs1[.]ccwu[.]cc Domain xss[.]xs1[.]ccwu[.]cc Domain c[.]xs1[.]ccwu[.]
domainxss.xs1.ccwu.ccIP 202[.]160[.]76[.]174 Domain vps[.]xs1[.]ccwu[.]cc Domain xss[.]xs1[.]ccwu[.]cc Domain c[.]xs1[.]ccwu[.]cc Domain attacker-collector[
ipv4112.121.185.218idence. Indicators of compromise (IoCs):- Type Indicator IP 112[.]121[.]185[.]218 IP 156[.]240[.]109[.]26 IP 49[.]158[.]237[.]136 IP 20
ipv4156.240.109.26promise (IoCs):- Type Indicator IP 112[.]121[.]185[.]218 IP 156[.]240[.]109[.]26 IP 49[.]158[.]237[.]136 IP 202[.]160[.]76[.]153 IP 20
ipv4202.160.76.15385[.]218 IP 156[.]240[.]109[.]26 IP 49[.]158[.]237[.]136 IP 202[.]160[.]76[.]153 IP 202[.]160[.]76[.]154 IP 202[.]160[.]76[.]155 IP 20
ipv4202.160.76.154109[.]26 IP 49[.]158[.]237[.]136 IP 202[.]160[.]76[.]153 IP 202[.]160[.]76[.]154 IP 202[.]160[.]76[.]155 IP 202[.]160[.]76[.]156 IP 20
ipv4202.160.76.15537[.]136 IP 202[.]160[.]76[.]153 IP 202[.]160[.]76[.]154 IP 202[.]160[.]76[.]155 IP 202[.]160[.]76[.]156 IP 202[.]160[.]76[.]157 IP 20
ipv4202.160.76.15676[.]153 IP 202[.]160[.]76[.]154 IP 202[.]160[.]76[.]155 IP 202[.]160[.]76[.]156 IP 202[.]160[.]76[.]157 IP 202[.]160[.]76[.]174 Domai
ipv4202.160.76.15776[.]154 IP 202[.]160[.]76[.]155 IP 202[.]160[.]76[.]156 IP 202[.]160[.]76[.]157 IP 202[.]160[.]76[.]174 Domain vps[.]xs1[.]ccwu[.]cc
ipv4202.160.76.17476[.]155 IP 202[.]160[.]76[.]156 IP 202[.]160[.]76[.]157 IP 202[.]160[.]76[.]174 Domain vps[.]xs1[.]ccwu[.]cc Domain xss[.]xs1[.]ccwu[
ipv449.158.237.136dicator IP 112[.]121[.]185[.]218 IP 156[.]240[.]109[.]26 IP 49[.]158[.]237[.]136 IP 202[.]160[.]76[.]153 IP 202[.]160[.]76[.]154 IP 20

From the original article

4 min read at cybersecuritynews.com

A single operator in Taiwan built a team of 12 AI agents and used it to attack hundreds of organizations in 11 countries. The campaign hit emergency services, banks, universities, and military systems. It led to confirmed theft of medical data and personal records.

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.