618/69 Thuesday, November 10, 2026
Researchers from the Acronis Threat Research Unit (TRU) have disclosed a campaign in which attackers used a system called BOSSAI, consisting of 12 AI agents, to support cyber operations against hundreds of targets across at least 11 countries. The targets included government agencies, educational institutions, financial organizations, and emergency services. Researchers found evidence of system access or data exfiltration from approximately 10 targets across three countries, including universities in Thailand. Some other targets were only scanned for vulnerabilities or subjected to attempted attacks, with no evidence confirming successful compromise.
The report stated that BOSSAI had nine actively used AI agents responsible for target reconnaissance, vulnerability assessment, and supporting attacks through security testing tools connected via MCP. The attacker remained in control and passed information between the AI agents. Researchers identified 489 potential targets across 45 universities in Thailand, followed by testing for SQL Injection vulnerabilities. Evidence of data exfiltration was found at three universities, including administrator and student information, while two additional universities were found to have exploitable vulnerabilities but showed no confirmed evidence of successful data theft. Researchers also identified access to emergency reporting data in the Taipei area and a patient information system that was exposed without authentication. Some AI agents generated false vulnerability findings and were unable to access systems protected by properly configured access controls.
Administrators should review internet-facing websites and services, particularly databases and web applications that may be vulnerable to SQL Injection. Affected software should be updated, database privileges restricted, and unnecessary administrative access paths disabled. Organizations should also review web and database logs for unusual requests or large-scale data extraction and compare observed activity against the Indicators of Compromise (IoCs) published by Acronis. If unauthorized access is identified, organizations should assess the scope of impact, rotate affected credentials, and initiate incident response procedures in accordance with internal processes.
Source: https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html