In a report published on October 27, 2026, the TrendAI research team (Trend Micro) documents three attack infrastructures primarily targeting Japan, each illustrating a different level of AI use. In the most advanced case, the open-source tool CyberStrikeAI split the work across 44 AI agents, from reconnaissance to the final report. Yet the most important finding for defenders lies elsewhere: no novel vulnerability was needed.
- Three separate attack infrastructures, three levels of AI: autonomous agent-driven execution, human-led AI assistance, and limited help with tool development.
- Using CyberStrikeAI, at least 19 organizations, including at least 16 in Japan, were subjected to attack activity in October 2026.
- Entry points were classic: unauthenticated administration interfaces, default credentials, VPN appliances and legacy web systems.
- AI increases the speed and scale of attacks; it does not replace the fundamentals. Attack surface hygiene remains the most cost-effective defense.
What the researchers observed
Researchers Bakuei Matsukawa and Joseph C. Chen analyzed files left by the attackers in open directories. Their report, “Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan”, builds on previously published work on ARTEX, an autonomous AI penetration-testing system. The three infrastructures studied are, however, distinct from ARTEX, and the evidence does not establish any link between their operators.
| Case | Role of AI | Period | Targets and entry points |
|---|---|---|---|
| A — CyberStrikeAI | Autonomous execution of the full attack workflow by 44 agents | October 2026, within a short window | Legacy web systems at SMBs and local public bodies; administration interface reachable without authentication |
| B — Assisted operator | Planning and tool development; decisions made by the human | August–September 2026 (about 24 days) | Legacy systems and exposed AI/GPU infrastructure; GIS server reachable with default credentials |
| C — Limited assistance | Script development (AI attribution based on stylistic indicators) | January–October 2026, at least six campaigns | Exposed VPNs (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210) and WebLogic servers |
Case A: 44 agents for a complete attack chain
CyberStrikeAI is an open-source, AI-agent-based penetration-testing tool, abused here as an attack platform. A log entry, “credential-search agent 8/44”, reveals a configuration of 44 specialized agents: reconnaissance, vulnerability discovery and validation, exploitation, then command and control, persistence, exfiltration and automatic report writing for each target. The tool also produced Japanese-language forms and fake login pages.
Two details stand out. Traffic was deliberately throttled per target to stay below detection thresholds. And despite this industrialization, deep compromise remained rare: many targets were recorded as “no session, no web shell, no exfiltration”.
Case B: AI as the attacker’s copilot
Here, a human operator relied on an LLM to plan actions and develop tools. More than 6,000 Japanese IP addresses were scanned. A GIS server exposed with default credentials gave access to records, Windows credentials and email. At one company, the attacker obtained a full control chain (FTP, database, administrator privileges, web shell, SSH) and repeatedly restored backdoors after cleanup. The theft of several hundred thousand cadastral and commercial records was confirmed there.
The report also highlights a guardrail bypass technique: framing the request to the model as an authorized assessment. The attacker also went after exposed inference services and AI workflow platforms, most likely to obtain cheap compute capacity.
Case C: edge devices in the crosshairs
The third set targeted more than 1,300 candidate WebLogic servers and at least 35 VPN entry points. For the Yamaha RTX1210, no product vulnerability was exploited: credentials recovered from configuration files were enough to connect directly to internal networks.
Why it matters for your organization
This report confirms an underlying trend: AI lowers the cost of running an attack campaign. A single operator can now sweep thousands of systems, test credentials, document results and adapt lures to the local language. The preferred targets are not the best-defended systems but the most forgotten ones: old web applications, administration consoles published by mistake, misconfigured VPN appliances.
Another signal to take seriously: your own AI services are becoming targets. Inference platforms, LLM pipelines and GPU resources exposed to the internet attract attackers looking to consume that capacity at your expense.
MITRE ATT&CK view
The report does not provide an ATT&CK mapping. The table below is an indicative Defensy reading based on the behaviors described, to help your SOC teams prioritize detection rules.
| Technique | Observed behavior |
|---|---|
| T1595 — Active Scanning | Mass scanning of Japanese IP addresses (case B) and WebLogic servers (case C) |
| T1190 — Exploit Public-Facing Application | Exploitation of legacy web systems and published vulnerabilities in edge devices |
| T1078.001 — Default Accounts | GIS server reachable with default credentials |
| T1552.001 — Credentials In Files | Credentials extracted from VPN configuration files |
| T1133 — External Remote Services | Direct connection to internal networks through the VPN |
| T1505.003 — Web Shell | Web shell deployed and restored after cleanup |
Recommendations
The recommendations below build on the priorities published by TrendAI, complemented by our field experience.
- ImmediateInventory everything exposed to the internet
List your web applications, administration consoles, VPNs and AI services reachable from outside. Update or isolate legacy platforms: they were the number one target in all three campaigns.
- ImmediateEliminate default credentials and public administration interfaces
No administration console should be reachable without strong authentication. Systematically check for default accounts on exposed devices and software.
- Short termHarden edge devices
Patch VPNs and gateways (virtual patching if needed), protect configuration files and check for credential reuse across devices.
- Short termCheck the exposure of your AI services
Inference services, LLM workflow platforms and GPU resources must not be published without access control. Monitor their consumption to detect misuse.
- Medium termTune detection for slow, distributed attacks
AI agents deliberately throttle traffic per target. Correlate low-frequency attempts over long periods rather than relying on volume thresholds.
- Medium termGovern internal LLM use
Prepare for false-premise misuse (“this is an authorized test”): usage policy, prompt logging and controls on deployed models.
These campaigns rely on no sophisticated exploit: they exploit what organizations do not know about themselves. Knowing your attack surface before the attacker does has become essential when the attacker runs dozens of automated agents.
With IGIDER Strike, our teams continuously identify exposed assets and truly exploitable vulnerabilities. With IGIDER Watch, our SOC detects the weak signals of slow, distributed attacks. And our Secure AI Adoption offering helps you protect your own AI services.
- Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting JapanTrendAI (Trend Micro) — B. Matsukawa, J. C. Chen — October 27, 2026
- CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan TargetsThe Hacker News — October 2026
- MITRE ATT&CK® — Enterprise MatrixMITRE Corporation
