CyberStrikeAI Japan Attacks: 44 Agents Against Japanese Targets

TrendAI analyzed three exposed attacker server environments used against organizations in Japan. In the CyberStrikeAI Japan attacks, 44 agents subjected at least 19 identifiable organizations to validation activity in a short window in October 2026. At least 16 were in Japan. Each had a same-format report and an evidence index. The other two environments show the same reporting’s quieter pattern. A human sped up by a model worked 24 days in August and September 2026. A third operator used AI only to write tools for edge-device campaigns from January through October 2026.

What did TrendAI find on the three attacker servers?

Trend Micro’s enterprise security division, called TrendAI in the reporting, analyzed three exposed attacker server environments used against organizations in Japan. Bakuei Matsukawa and Joseph C Chen found reconnaissance and attack tools, scripts, target lists, results, logs, and command histories on those hosts.

The workspaces ran from mostly hands-on operator desks to an agent platform that automated the workflow, including command and control. AI sat at a different point in each operation. TrendAI says there is no evidence the three cases share an operator. Which models were called is unknown. Whether activity reached regions that never appeared on these lists is also unknown.

The first operator also targeted organizations in Taiwan and Hong Kong. The third operator’s WebLogic discovery lists named organizations in the U.K., France, Italy, Qatar, and Colombia. A name on a list is a hunt, not a confirmed breach. Japan is where the servers were readable, not the edge of the target set.

Read them as levels of delegation. Fund controls for whichever level shows up. A platform, a human with a model, and a tool-writer leave different logs, and the first alert rarely names which one you have. Uniform report bundles point at the agent platform. Inference invoices and prompt logs point at the assistant. Config-file credentials and published edge bugs point at the experienced operator.

The three servers are a concrete set for agentic AI threat modeling: where the human stops, where the model only drafts, and where a platform is allowed to carry command and control.

Case	Who decided	Window	What the server showed
1 — CyberStrikeAI	44-agent platform across the workflow, including C2	Short period, October 2026	At least 19 orgs under validation activity, at least 16 in Japan; same-format reports and evidence indexes; Japanese fake login pages
2 — human plus LLM	Operator; model used for planning and tools	24 days, August–September 2026	GIS server on default credentials; cadastral and commercial records, Windows credentials, email; hunt for cheap inference
3 — AI as author	Experienced operator; AI wrote tools and scripts	At least six campaigns, January–October 2026	Cisco, Citrix, F5, Yamaha edge devices and internet-facing WebLogic; published bugs, management functions, or credentials in config files

TrendAI puts it precisely: “AI has increased the attackers’ workforce, but the work still consists of looking for unlocked doors.” What changed is the ability to try thousands of those doors at once, adapt to the target country’s language, and continue without fatigue. “The key issue is not simply whether an actor has frontier AI.” Ecosystem depth decides how reliably, and at what scale, those gains hold. “AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns.” On these servers the model sat in three chairs: platform, assistant, and script author.

How did the CyberStrikeAI Japan attacks automate October 2026?

In the CyberStrikeAI Japan attacks, an operator pointed the open-source tool’s 44 agents at a repeatable workflow during a short window in October 2026. The same tool had already been used against Fortinet FortiGate appliances.

TrendAI puts it precisely: “In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity.” Each organization had a report in the same format and an index of evidence. Those packs came from a structured platform process.

The platform is built to run reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, exfiltration, and automated reporting. Japanese-language forms and fake login pages came off the same platform. Taiwan and Hong Kong were on this operator’s list as well.

TrendAI does not claim every name was fully compromised. Validation activity plus a tidy evidence index is a lead. It becomes an incident when VPN, identity, application, and host telemetry agree with that window.

On assessments we run, the giveaway of a platform-driven pass is sameness. Human notes wander. A 44-agent run tends to emit one report skeleton, one evidence index, and lure pages in the victim’s language. If your brand shows up on a lookalike login you did not publish, preserve the page, the host, and the submission endpoint. Match that URL and time to identity logs for the accounts the form asked for.

What to query for case 1

Watch a burst of requests against the same application path, many of them 4xx, followed by a successful login from a new source. Pair that with hits on a lookalike-page submission endpoint that posts credentials your identity provider never tied to a real session. Preserve the page HTML, the hosting IP, and the form action. Identical evidence-index filenames across targets are a platform tell.

The earlier FortiGate use is reuse of a public red-team framework. That failure mode is tool-use abuse of a pentest platform, the same class covered in work on autonomous agents and credential theft. A ticket that says “fake login, our logo, Japanese text” should reach the identity team the same day, with the URL and the time.

Taiwan and Hong Kong on the same list means a Japan-only hunt under-counts the campaign if your group has entities there. Pull vendor indicators from Trend Micro’s advisory rather than reconstructing command lines from a news write-up. Stolen AI-provider session tokens, and offensive tools sold as APEX AI, MessiahGPT, and DarkGPT, are already on the market. Treat those sessions as privileged credentials: short lifetime, device binding, and no path from a chat session to production cloud keys.

What did the 24-day intrusion and the edge-device operator do?

The second campaign was human-led and LLM-assisted. It ran 24 days across August and September 2026. The model sped planning and tool development. The activity also aimed at AI workflow platforms and inference services, to obtain a large amount of inference capacity at low cost. That log is provider invoices, new API keys, and workflow-platform sign-ins that do not match your tenants.

One intrusion hit a geographic information system server exposed with default credentials. From that host the operator stole cadastral and commercial records, Windows credentials, and email data. There is no CVE to patch if the account was still the vendor default. TrendAI’s recorded loss is the records, the Windows credentials, and the email. The fix on the host is rotation, removal of factory accounts, and management interfaces that are not on the internet.

What to query for case 2

The telemetry that matters is a successful management login from a new source, a configuration export, a new local administrator, and unusual use of a service account. Exploit signatures stay quiet because a valid account is allowed in. On the inference side, alert when a workflow platform or model API shows a new key created outside change control, then a sustained token burn with no matching internal project.

The third operator ran at least six campaigns from January to October 2026. Targets were exposed VPN devices and edge gear from Cisco, Citrix, F5, and Yamaha, plus internet-facing WebLogic servers. Access used published vulnerabilities, management functions, or credentials already sitting in configuration files.

TrendAI’s judgment: “The operator was experienced, with established practices for automation and evidence management.” WebLogic discovery lists included organizations in the United Kingdom, France, Italy, Qatar, and Colombia. A name on that list is not a named breach. Automation increases how many appliances an operator can try in the hours after a write-up ships.

Microsoft’s 2026 Digital Defense Report, cited with these cases, says AI has pushed the median time from vulnerability discovery to weaponization well below 24 hours. Microsoft added that AI is cutting the time, expertise, and cost required to find and exploit weaknesses, while attackers and defenders both gain speed and scale. On case 3 the speed shows up as more tries against gear you already own.

What to query for case 3

For this operator, “experienced” is the defensive clue. On your side the intrusion may look boring: a management login from a new network, a configuration read in the same hour, then a published bug used as documented against that appliance. Yamaha, Cisco, Citrix, and F5 gear plus WebLogic is a VPN-and-middleware estate. Inventory those interfaces by owner. If the owner cannot show the last credential rotation and the last emergency change, that box matches the GIS host: a valid account on an internet-facing management plane.

Where does this agentic AI pattern sit next to Storm-0940 and ARTEX?

In the same reporting window, Microsoft described a larger agentic AI pattern than the Japan servers. The China-state-aligned actor Storm-0940 compromised a ConnectWise cloud backup application and used a framework called ARTEX to sign in to more than 2,250 Microsoft 365 tenants.

Microsoft said Storm-0940 has used that framework since as early as September 2026 to automate password-spraying against hundreds of organizations. “While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.”

CyberStrikeAI’s October window is a 44-agent pentest platform aimed at identifiable organizations, many of them in Japan. ARTEX, in Microsoft’s account, is spraying and session abuse at tenant scale, using privileged authentication material. Both do repetitive identity work. They are not the same tool. TrendAI does not link its three operators to Storm-0940. It also separated these environments from earlier published attacks that used ARTEX against entities in South Korea and Japan.

South Korean authorities identified seven suspects in a cybercrime operation that breached more than 90 organizations, most of those incidents involving ARTEX. Local reporting says the alleged 32-year-old mastermind worked at a cybersecurity company from 2019 to 2022 and learned penetration testing there. Authorities put a ransom demand on 38 of the incidents: 360 million won, about $270,000, in exchange for not leaking stolen data. They believe more than 8.2 million records were taken. Those figures are what authorities reported. They are not counts from the Japan servers. Offensive skill learned in a legitimate security job is showing up in suspected criminal use of an automation framework.

The wider 2026 set has the same shape at different scales. We tracked that June–October run in the five months when the attacker was the AI. Unit 42 described BUGSTER configuring the Hermes Agent framework with DeepSeek V4 and Cursor, both with safety controls disabled, then a WordPress guessing campaign against an Indian university site. BUGSTER-linked activity hit at least two further Indian targets, including a database of more than 5,200 records with student personal data, and enumerated an e-commerce site for a storefront API token, admin emails, and payment merchant IDs. The actor also built bot profiles for VoIP fraud expertise and kept pipelines for Wi-Fi password cracking and cryptocurrency-holder reconnaissance. Wi-Fi cracking needs physical proximity, which Unit 42 read as local access.

Straiker described CyberCartel running CARLIY0S against banks and payment providers in Latin America: four role-specialized Claude models debate each target and defer to one arbiter before an orchestrator acts. The Gentlemen ransomware affiliate used Anthropic’s Claude Code during intrusions into at least six organizations in late June 2026, for reconnaissance and exploitation commands, malicious scripts, firewall-policy changes, and identification of high-value business systems. Zerofot’s scanner auto_scan integrated OpenAI Codex and Claude Code and collected thousands of API keys and tokens from thousands of exposed hosts.

Unit 42 reported a separate human operator who breached an enterprise network over about 10 hours. Entry was a public web service used as a tunnel; sub-agents pulled hard-coded tokens and service passwords from code repositories; stolen cloud keys turned the victim’s own AI endpoints into post-compromise infrastructure. Hunt.io described a suspected Russian-speaking actor using an AI-assisted workflow against PaperCut NG/MF servers and compromising hundreds of instances, continued into Windows credential collection, Metasploit automation, and victim packaging (hundreds of AI agents against PaperCut). Rapid7’s summary fits the set: generative AI cuts the time, skill, and coordination previously required to run established methods at scale.

What should defenders measure when the operator is a platform?

Measure three clocks, one per case. For CyberStrikeAI, measure minutes from the first repeated probe of an app path to a lookalike login in the victim’s language. For the GIS intrusion, measure whether a factory account on a management plane can still read records and mail. For the edge operator, measure hours from a public write-up to a try against Cisco, Citrix, F5, Yamaha, or WebLogic.

Do not collapse those clocks into one “AI incident” ticket. The October packs are uniform validation reports. The August–September intrusion is a default login plus a hunt for cheap inference. The January–October campaigns are published bugs and credentials already in config files. Each has a log source you already own.

Identity teams should treat Japanese fake-login submissions as credential events even when no shell follows. Cloud and platform owners should treat new model-API keys the way they treat new VPN accounts. Network owners should keep management interfaces off the internet and show the last rotation date without a war room. Microsoft’s sub-24-hour weaponization median, from the 2026 Digital Defense Report, is the scheduling constraint for case 3. A patch cycle measured in weeks is longer than the window TrendAI’s third operator was built to use.

AI agent penetration testing is the right test when the question is whether a 44-agent workflow can validate your apps, mint a lure in your language, and leave an evidence index before a human opens a ticket. An external network penetration test shows which management plane is still reachable. Threat modeling sets the trust boundary. The test shows which log actually fires.

FAQ

What is CyberStrikeAI and how was it abused?

CyberStrikeAI is an open-source penetration-testing tool that delegates work across 44 agents, from reconnaissance and vulnerability validation through exploitation, command and control, persistence, exfiltration, and automated reporting. TrendAI says an operator abused it in a short October 2026 window, including Japanese fake login pages, after earlier use against Fortinet FortiGate appliances.

Did CyberStrikeAI attack organizations in Japan?

TrendAI says at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity, each with a same-format report and an evidence index. The source does not say exploitation, persistence, or exfiltration were completed against all 19; Taiwan and Hong Kong were also on that operator’s lists.

Are the three Trend Micro Japan cases linked?

No. TrendAI says there is no evidence the three incidents share an operator: case 1 is the CyberStrikeAI platform, case 2 a human with an LLM, and case 3 an experienced operator who used AI to write tools. The models used are unknown.

How fast are vulnerabilities weaponized with AI in 2026?

Microsoft’s 2026 Digital Defense Report, cited with these cases, says AI has pushed the median time from vulnerability discovery to weaponization well below 24 hours. That median is why a monthly patch window on VPN and middleware management planes is longer than the third operator’s try-rate.

If your edge estate or your own agents would not survive a 44-agent validation pass, AI-powered penetration testing puts a human operator over a team of models and shows which management plane fails first.