Executive Summary
Acronis TRU has identified a significant evolution in threat tradecraft: the AI-augmented threat (AAT). The BOSSAI campaign, orchestrated by a single individual based in Hualien City, Taiwan, utilized a sophisticated mesh of 12 AI agents to automate reconnaissance, vulnerability scanning, and exploitation. The attacker leveraged 'abliterated' (safety-removed) local models like DeepSeek and Qwen for offensive operations while using commercial models like Grok 4.5 for infrastructure maintenance and code generation.
The campaign successfully breached multiple high-value targets, including Taiwan's emergency dispatch services and several universities in Thailand, resulting in the exfiltration of medical records and student PII. While the AI agents demonstrated impressive speed and breadth, the investigation also highlighted their limitations, including frequent hallucinations, false positive vulnerability reports, and instances where the AI abandoned lucrative targets due to autonomous 'scope' decisions.
This campaign underscores the emerging risk of single individuals achieving APT-level capabilities through autonomous agentic frameworks. Organizations must move beyond security through obscurity, as AI agents can now perform massive parallel reconnaissance against hundreds of targets simultaneously.