AI-Driven Attacks Target Japan with Automated Hacking Tools

Forty-four AI agents were orchestrated to carry out an end-to-end intrusion workflow, producing standardized reports and Japanese-language fake login pages as part of a concentrated October 2026 campaign, researchers report.

CyberStrikeAI's 44-agent workflow

TrendAI's analysis of exposed server environments shows one campaign that abused the open-source penetration testing tool CyberStrikeAI to automate reconnaissance, vulnerability validation, exploitation, command-and-control (C2), persistence, data exfiltration, and automated reporting. Researchers Bakuei Matsukawa and Joseph C Chen wrote that the environments “held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories.” They added: “They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control.”

That first case delegated work “among 44 agents” and produced uniform outputs: Trend Micro's enterprise security division said, “In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity. Each had a report in the same format and an index of evidence. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator.” Activity tied to CyberStrikeAI was concentrated in a short period in October 2026.

Human-led, LLM-assisted intrusion that stole cadastral and email data

A second incident was described as human-led but accelerated by a large language model (LLM). The campaign’s infrastructure and artifacts suggest a goal of targeting AI workflow platforms and inference services to obtain inference capacity at low cost. One intrusion focused on a geographic information system (GIS) server exposed with default credentials and resulted in theft of cadastral and commercial records, Windows credentials, and email data. That campaign spanned 24 days in August and September 2026.

Edge-device and WebLogic campaigns spanning regions

In the third case, AI’s role was limited to helping develop tools and scripts. That operator targeted edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, management functions, or credentials found in configuration files. TrendAI estimated the actor ran at least six campaigns from January to October 2026, “opportunistically striking exposed VPN devices and WebLogic servers.” The same WebLogic discovery lists included organizations in the U.K., France, Italy, Qatar, and Colombia; the first operator also targeted organizations in Taiwan and Hong Kong. Researchers characterized the operator as experienced, noting “established practices for automation and evidence management.”

Related AI-powered operations and the commodification of offensive tools

TrendAI placed these three incidents in a broader pattern of multiple, recent campaigns where agentic AI has been grafted onto established offensive workflows. Microsoft’s 2026 Digital Defense Report was cited to emphasize speed: “AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours.” Microsoft also disclosed a separate incident in which a China-state-aligned actor used ARTEX after compromising a ConnectWise cloud backup application to sign in to more than 2,250 Microsoft 365 tenants. Microsoft observed: “While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” and that the activity “illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations.”

Researchers and vendors documented a range of other AI-enabled campaigns: a financially motivated actor known as BUGSTER configured the Hermes Agent framework with DeepSeek V4 to run WordPress brute-force and data-exfiltration operations; CyberCartel used a multi-agent system called CARLIY0S against Latin American financial targets; an offensive agent was built to hijack exposed AI endpoints and run up inference costs while the legitimate owner paid; an affiliate for The Gentlemen used Anthropic Claude Code in intrusions; an operation named Zerofot harvested thousands of API keys with tools integrating OpenAI Codex and Claude Code; and an autonomous engine called Cairn was tasked to probe and break into targets including more than 100 companies. TrendAI underscored the market effect: stolen AI provider session tokens and offensive AI tools APEX AI, MessiahGPT, and DarkGPT are being bought and sold, “further commoditizing cybercrime and lowering the barrier to entry.”

What this means for technologists, policymakers, and enterprises

• Technologists and security teams: prioritize detection and mitigation of automated attacker workflows—look for evidence of uniform, structured outputs such as standardized reports and indexes of evidence; monitor exposed management interfaces, default credentials, WebLogic and VPN endpoints, and GIS servers.
• Policymakers and regulators: the trend shows a commodified market for stolen session tokens and offensive AI tools; regulators will confront questions about access to inference resources, attribution, and cross-border abuse of AI endpoints.
• Affected enterprises and procurement leaders: expect attackers to scale tried-and-true techniques with agentic AI—patch and reduce exposure for VPNs, WebLogic, and other internet-facing services, and audit use of default credentials and configuration files that may leak access.

TrendAI summarized the dilemma crisply: “AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors.” The technologies and markets described in these incidents have accelerated attackers’ reach and reduced the friction of large-scale operations, yet the basic defensive task remains the same: lock the doors, remove default access, and hunt for the structured, machine-produced artifacts that now accompany intrusions. It remains unknown whether the three case sets share an operator and which AI models were used to carry them out.

https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html