Acronis TRU: BOSSAI attack mesh targeted Taiwan emergency services

Evidence record

Incident responder reconstruction of human-operated, multi-agent offensives, observed exfiltration, model refusals and local modified models.

Read the original source ↗

Claim-level citations (5)

• supportsBOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits: Acronis TRU describes one operator deploying 12 role-specific agents in a BOSSAI mesh against organizations in 11 countries, with a narrower set of breaches and exfiltration verified by investigators.

  Summary; Introduction; A shape of things to come; Victims

• supportsBOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits: Acronis reports confirmed unauthorized access and exfiltration involving Taiwan emergency-service records and some Thai university data, but does not substantiate compromise of every enumerated target.

  Victims: Taiwan and Thailand; Summary distinction between targeted and confirmed compromises

• supportsBOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits: Acronis observed that commercial hosted models were used to help build attack infrastructure but refused direct offensive exploitation requests, prompting use of locally run safety-modified models.

  Summary bullets on model refusals and local abliterated models

• supportsBOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits: Acronis reports HalberdStrike configuration with scope enforcement disabled and all command risk tiers auto-approved, while some local-model scans mislabeled failed connections as exploitable vulnerabilities.

  Arsenal exposure and attribution, HalberdStrike operation and output quality

• supportsBOSSAI gave one operator a 12-agent offensive mesh, with verified data theft and important autonomy limits: Acronis documents that the BOSSAI operator copied scanning reports from HalberdStrike into Hermes and then into Cursor for exploitation; this was human-mediated orchestration, not a fully autonomous direct agent-to-agent communication bus.

  A shape of things to come: Unraveling the BOSSAI mesh; operator passing HalberdStrike, Hermes and Cursor outputs between terminals