CyberStrikeAI Automates Attacks Against Japan Targets

Researchers disclosed three attacks against Japanese organisations in which AI played different roles. TrendAI said the servers it examined held reconnaissance and attack material, target lists, logs and command histories, and that the setups ranged from manual workspaces to automated agent platforms.

The first case used CyberStrikeAI, an open-source testing tool that had previously appeared in an attack against Fortinet FortiGate appliances. TrendAI said the October 2026 campaign used 44 agents to cover reconnaissance, vulnerability checking, exploitation, persistence, theft and reporting, and to produce Japanese-language forms and fake login pages.

Trend Micro's enterprise security division said at least 19 identifiable organisations were checked in a short period, including at least 16 in Japan. It said each received a report in the same format and an evidence index, which it said pointed to a structured platform rather than informal notes.

The second case was described as human-led, with a large language model used to speed planning and tool development. One intrusion hit a GIS server with default credentials and led to the taking of cadastral and commercial records, Windows credentials and email data over 24 days in August and September 2026.

In the third case, AI was limited to developing tools and scripts, while the campaigns targeted edge devices from Cisco, Citrix, F5 and Yamaha using published vulnerabilities, management functions or credentials in configuration files. The researchers said the actor had run at least six campaigns from January to October 2026, and that there was no evidence the three incidents shared one operator.