AI-driven intrusions hit Japan: CyberStrikeAI runs 44 agents against 19+ organizations in three exposed attacker environments (TrendAI)

Linha do tempo

1. securityaffairs.com ↗ · pub. 28/10/2026 05:34 · coletado 28/10 08:00

   Trend Micro analyzes three Japan-focused attack infrastructures using AI, from agent-driven CyberStrikeAI to AI-assisted tooling

   ler a análise desta fonte ocultar

   Trend Micro researchers studied three attacker-side infrastructures active in 2026, found on openly accessible servers, that targeted organizations mainly in Japan and used AI to different degrees. The activity coincides with a series of autumn 2026 data leaks affecting Japanese web systems and an October 9 warning from Japan's National Cybersecurity Office. Researchers could not see victim-side logs, so they could not confirm every intrusion, measure total damage or attribute the activity. All three operations used Simplified Chinese as the working language, which does not prove a shared operator. Attackers relied on known weaknesses such as legacy web systems, exposed admin pages and default credentials, and no AI-discovered zero-days were observed.

   Technical Details

   • Case A (confirmed full AI workflow): the open-source AI-agent pentest platform CyberStrikeAI handled reconnaissance, vulnerability checks, exploitation, data theft and reporting. One record referenced a system with 44 agents, including a credential-search agent. It generated Japanese content such as forms and fake login pages. At least 19 organizations were targeted, at least 16 of them in Japan. It ran low-volume traffic against many targets at once, which makes detection from a single victim's logs harder. It rarely achieved deep access; the clearest intrusion came through a publicly accessible admin page on an old web system.
   • Case B (human-led, AI-assisted): the operator used an LLM for planning and tool development, falsely framing requests as authorized security testing to bypass safety limits. Targets included AI/GPU service providers and AI workflow, data processing and inference platforms, possibly to obtain cheap compute. One intrusion gave control over an FTP service, a database, an admin account, a web shell and SSH, and backdoors were restored after removal. A GIS server exposed with default credentials led to confirmed download of hundreds of thousands of land and business records, Windows credentials and email data.
   • Case C (limited AI role, high confidence but unconfirmed): AI probably helped develop tools and scripts, indicated by unusually structured comments and emoji status markers. At least six 2026 campaigns targeted exposed VPN devices and Oracle WebLogic servers, including Cisco, Citrix, F5 and Yamaha devices. Against Yamaha RTX1210 routers, credentials found in configuration files gave direct access to internal corporate networks, with no product vulnerability exploited.
   • AI tools sometimes reported planned actions as successful, so results need verification.

   Remediation

   • Review public-facing systems; update or isolate legacy web applications.
   • Restrict administration pages and management interfaces, with strong access controls.
   • Secure VPNs and network devices: remove default credentials and check for reused passwords.
   • Include AI workflows, inference services and GPU systems in asset inventories and check their exposure.
   • Monitor for low-volume attacks spread across many targets.
   • Train staff to recognize LLM requests that falsely claim authorized security testing.
   • Apply security updates quickly, and use temporary mitigations when patches are unavailable.
2. gbhackers.com ↗ · pub. 28/10/2026 05:20 · coletado 28/10 06:00

   AI-assisted intrusion operations target Japanese organizations in three exposed attacker infrastructures, including CyberStrikeAI abuse

   ler a análise desta fonte ocultar

   Researchers analyzed three exposed attacker-controlled infrastructures and found threat actors using AI to automate intrusion workflows, plan attacks and build credential-theft tooling against Japanese organizations. The level of AI involvement differs by case, from autonomous agents to human operators using generated scripts. The research follows a warning from Japan's National Cybersecurity Office on October 9, 2026, issued after incidents involving compromised web systems and stolen personal information. The infrastructures are separate from earlier ARTEX activity. Simplified Chinese appears in all three, but the article says this does not establish nationality or shared attribution.

   Technical Details

   • Case A: confirmed abuse of CyberStrikeAI, an open-source AI-agent penetration-testing platform. It chained reconnaissance, vulnerability validation, exploitation, C2, persistence, exfiltration and reporting. One record references "credential-search agent 8/44", implying 44 agents. It generated Japanese-language forms and fake login pages and throttled traffic per target. At least 19 organizations (16 in Japan) saw validation activity, but deep compromise was rare. The clearest intrusion started from an unauthenticated administration interface, not a novel vulnerability.
   • Case B: human-directed, with confirmed AI help for planning and tool development. An LLM-generated plan covered AI and GPU services, and requests were framed as authorized security testing. The operator scanned at least 6,000 Japanese IPs but focused on few companies. One victim showed control over FTP, databases, admin privileges, a web shell and SSH, with backdoors restored after cleanup. Another intrusion used default credentials on a GIS server, with evidence of theft of several hundred thousand cadastral and commercial records, Windows credentials and email. The infrastructure also held mechanisms to hijack access to AI services for cheap inference.
   • Case C: targeted exposed VPN devices and Oracle WebLogic servers (at least 1,300 WebLogic candidates and 35 VPN entry points), including Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP and Yamaha RTX1210. RTX1210 access used credentials recovered from configuration files, not a vulnerability. AI assistance is assessed with high confidence from code style, but no prompts or API keys confirm it.
   • Caveats: attacker-side records cannot confirm every claimed compromise or full victim impact. TrendAI notes Japan recorded more disclosed incidents in the first nine months of 2026 than in all of 2025, but this is not conclusively linked to AI.

   Remediation

   Japan's advisory recommends prompt patching, multifactor authentication, restricted privileges and stronger monitoring. TrendAI hardening guidance adds preventing uploaded files from executing, restricting application-code writes and monitoring database access controls.

3. thehackernews.com ↗ · pub. 27/10/2026 15:26 · coletado 27/10 17:00 primeiro registro

   AI-driven intrusion campaigns hit Japan: CyberStrikeAI runs 44 agents against 19+ organizations, per TrendAI

   ler a análise desta fonte ocultar

   TrendAI (Trend Micro) analyzed three exposed attacker server environments used against organizations in Japan, in which AI either drove the operation or assisted a human operator. The first case abused the open-source pentest tool CyberStrikeAI, which was previously used against Fortinet FortiGate appliances. It delegates work across 44 agents and automated the full attack lifecycle in a short period in October 2026. At least 19 organizations, 16 of them in Japan, were subjected to validation activity. The article also summarizes other recent AI-enabled campaigns, including Storm-0940 using ARTEX against more than 2,250 Microsoft 365 tenants, and a South Korean ransomware-style extortion operation. There is no evidence that the three Japan cases share an operator.

   Technical Details

   • Case 1 (CyberStrikeAI): 44 agents handle reconnaissance, vulnerability discovery and validation, exploitation, C2, persistence, data exfiltration and automated reporting. The platform generates Japanese-language forms and fake login pages. Each victim had a report in the same format plus an evidence index. The operator also targeted Taiwan and Hong Kong.
   • Case 2 (human-led, LLM-assisted): The LLM accelerated planning and tool development. The campaign also targets AI workflow platforms and inference services to obtain cheap inference capacity. One intrusion hit a GIS server exposed with default credentials, leading to theft of cadastral and commercial records, Windows credentials and email data. The campaign lasted 24 days in August-September 2026.
   • Case 3 (AI limited to tooling): The actor ran at least six campaigns from January to October 2026 against Cisco, Citrix, F5 and Yamaha edge devices and WebLogic servers, using published vulnerabilities, management functions or credentials in configuration files. WebLogic discovery lists included the U.K., France, Italy, Qatar and Colombia.
   • Related activity cited:
     • Storm-0940 (Microsoft) compromised a ConnectWise cloud backup application and used ARTEX for password spraying, signing in to more than 2,250 M365 tenants.
     • South Korean police identified seven suspects behind 90+ intrusions, with ransom demands of 360 million won in 38 incidents and more than 8.2 million records stolen.
     • BUGSTER used Hermes Agent with DeepSeek V4 against Indian universities and an e-commerce site (Unit 42).
     • CyberCartel used the multi-agent system CARLIY0S against Latin American banks (Straiker).
     • A Gentlemen ransomware affiliate used Claude Code in at least six intrusions.
     • Zerofot harvested API keys with auto_scan.
     • The RAGE framework scanned services and deployed miners.
     • A suspected Russian-speaking actor exploited PaperCut NG/MF (Hunt.io).
     • A Chinese-speaking actor used Cairn to breach 100+ company websites.
     • A "Skynet mode" agent hijacks exposed AI endpoints.
     • Stolen AI session tokens and tools such as APEX AI, MessiahGPT and DarkGPT are sold.

   Remediation

   The article gives no specific remediation. TrendAI notes the weaknesses exploited are unchanged (exposed devices, default credentials, known vulnerabilities, credentials in configuration files); AI only increases attack speed, scale and language adaptation.