Acronis researchers detail a campaign where a threat actor in Taiwan deployed 12 coordinated AI agents, named BOSSAI, targeting organizations across 11 countries.
The investigation reveals how unconstrained local models were leveraged for automated operations after commercial models refused malicious prompts.
The use of artificial intelligence in attacks
The attacker could not use popular commercial AI programs, such as Grok or MiniMax, as they refused to assist in illegal actions. Instead, he used local models (such as DeepSeek, GLM, and Qwen) from which he had removed security rules so that they could operate without restrictions. These agents scanned the Internet looking for weak points in organizations' systems.
What data was exposed?
The attacks led to the theft of significant amounts of personal information:
- Taiwan: The attackers stole records from emergency services, such as fire and ambulance services. A fire department platform was discovered that was accessible online without passwords, exposing sensitive medical data, such as ambulance videos and electrocardiograms. University and lending company systems were also compromised.
- Mexico: Approximately 206.800 records containing names and addresses of residents were stolen.
How was the perpetrator identified?
Researchers discovered a server that served as the attacker's control center, which contained 90.000 files, including attack tools and passwords. The attacker was identified because he used credentials that he had associated with other, legitimate activities, and left traces of his address during a login to the system.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Former OpenAI engineer pleads not guilty to placing recording devices in company offices
↗
According to Acronis, these attacks were only effective in cases where systems were poorly protected or did not have strong passwords. Where proper security measures were in place, the attacker's efforts failed.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)