Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.
TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX, an autonomous AI penetration testing framework, to single out entities in South Korea and Japan.
“These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories,” security researchers Bakuei Matsukawa and Joseph C Chen said. “They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control.”
The first of the three attacks has been found to abuse CyberStrikeAI, another open-source penetration testing tool that was previously put to use in an attack campaign targeting Fortinet FortiGate appliances. The activity was concentrated in a short period in October 2026.
The AI-driven activity leverages the offensive security tool to automate various aspects of the attack lifecycle into a repeatable workflow, beginning with reconnaissance and vulnerability discovery and validation, and exploitation, to command-and-control (C2), persistence, data exfiltration, and automated reporting.
This involves delegating the work among 44 agents to handle various aspects of the attack, while also enabling the generation of forms and fake login pages in the Japanese language.
“In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity,” Trend Micro’s enterprise security division said. “Each had a report in the same format and an index of evidence. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator.”
The second case has been characterized as a human-led attack with assistance from a large language model (LLM) to accelerate planning and tool development. Analysis of the infrastructure and artifacts indicates that the campaign is also designed to target AI workflow platforms and inference services with an aim to obtain large amounts of inference capacity at low cost.
One of the intrusions is said to have targeted a geographic information system (GIS) server exposed with default credentials, resulting in the theft of cadastral and commercial records, Windows credentials, and email data. The entire campaign lasted for 24 days in August and September 2026.
The third instance is where the AI’s role has been found to be confined to developing the operator’s tools and scripts, suggesting a limited role played by the technology in a series of campaigns designed to target edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, management functions, or credentials present in configuration files.
The threat actor is estimated to have run at least six campaigns from January to October 2026, opportunistically striking exposed VPN devices and WebLogic servers. “The operator was experienced, with established practices for automation and evidence management,” the researchers said.
There is currently no evidence at this stage that suggests these three incidents share an operator. It’s also unknown if the attacks have targeted other regions and what AI models are being used to pull off the attacks.
That said, the attacks involving these threat actors are not restricted to Japan and neighboring countries like South Korea. The operator behind the first case has targeted organizations in Taiwan and Hong Kong, while the third case featured organizations in the U.K., France, Italy, Qatar, and Colombia in its WebLogic discovery lists.
“AI has increased the attackers’ workforce, but the work still consists of looking for unlocked doors,” TrendAI said. “The types of doors and the weaknesses that leave them open have not changed. What has changed is the ability to try thousands at once, adapt to the target country’s language, and continue without fatigue.”
The development coincides with the discovery of multiple campaigns in which threat actors of varied motivations have integrated agentic AI into existing offensive security workflows, allowing them to speed up research, malware development, social engineering, and other parts of an attack.
To make matters worse, AI is being increasingly used to accelerate reconnaissance, automate decision-making, and industrialize social engineering, shortening the time between exposure and exploitation of security flaws. According to Microsoft’s 2026 Digital Defense Report, AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours.
The adoption of AI by bad actors is reducing the time, expertise, and cost required to discover and exploit weaknesses, at the same allowing attackers and defenders alike to operate with greater speed, scale, and autonomy, the Windows maker added.
“The key issue is not simply whether an actor has frontier AI,” Trend Micro said. “Access to capable models can already produce meaningful operational gains. Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained.”
“AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns.”
The growing demand for AI tools by threat actors has also opened up a new monetization avenue that peddles stolen AI provider session tokens and offensive AI tools APEX AI, MessiahGPT, and DarkGPT, further commoditizing cybercrime and lowering the barrier to entry for carrying out advanced, persistent, and evasive attacks.
Last week, Microsoft revealed that a China-state-aligned threat actor compromised a ConnectWise cloud backup application and used ARTEX to sign in to more than 2,250 Microsoft 365 tenants. The activity has been attributed to Storm-0940, which it said has used the framework since as early as September 2026 to automate password-spraying attacks on hundreds of organizations.
“While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” Microsoft said. “Storm-0940’s activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations.”
According to local media reports from South Korea, authorities have identified seven suspects linked to a cybercrime operation that broke into more than 90 organizations in the country, most of which involved ARTEX. The 32-year-old mastermind behind the activity is alleged to have worked at a cybersecurity company between 2019 and 2022, gaining expertise in penetration testing.
In 38 of the incidents, the threat actors demanded ransom payments of 360 million won ($270,000) in exchange for not leaking the stolen data. More than 8.2 million records are believed to have been siphoned from compromised organizations.
Some of the other AI-oriented campaigns that have been documented in recent weeks are listed below –
-
A financially-motivated threat actor operating under the handle
BUGSTER
configured the
Hermes Agent framework
with
DeepSeek V4
as its reasoning engine and Cursor as a secondary tool (both with safety controls disabled) to run a WordPress brute-force campaign against an Indian university’s website and generate a REST API enumeration report.- The attacker also breached a second Indian public university, exfiltrating a database of more than 5,200 records, including personally identifiable information (PII) on students. A third attack enumerated an Indian site on a popular e-commerce platform to extract a storefront API token, admin email addresses, phone numbers, and payment merchant IDs.
- “The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders),” Palo Alto Networks Unit 42 said. “Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations.”
- An e-crime group named CyberCartel has been observed using a multi-agent system called CARLIY0S to coordinate attacks against banks and payment providers across Latin America. The framework employs a cognitive swarm comprising four role-specialized Claude models that “debate each target and defer to one arbiter” before the main orchestrator acts. “The group assigned different roles to commercial AI models to analyze targets, develop attacks, and coordinate operations,” Straiker said.
- Threat actors have developed an offensive AI agent designed to hijack exposed AI endpoints to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval while the legitimate owner of the exposed endpoint pays for the inference. The system features a malicious loop called Skynet mode that employs a set of 74 tools to scan for targets, infect them, deploy cryptocurrency miners, and reinfect compromised hosts.
- An affiliate for the The Gentlemen ransomware operation has used Anthropic Claude Code during intrusions into at least six organizations in late June 2026, including to generate and execute reconnaissance and exploitation commands, write malicious scripts, modify firewall policies, and identify high-value business systems.
- A credential-harvesting operation codenamed Zerofot built a scanner named “auto_scan” that integrated OpenAI Codex and Claude Code to harvest thousands of API keys and tokens from thousands of exposed hosts across the internet.
- An AI-generated Python framework called RAGE has been used to scan internet-facing services (e.g., Redis, Elasticsearch, Docker, Apache Tomcat, Jenkins, Hadoop YARN, Confluence, and Supervisord), exploit vulnerable deployments, capture credentials, and deploy cryptocurrency miners.
- A human operator employed frontier AI models to breach an enterprise network autonomously over a 10-hour period. “The actor breached a publicly accessible web service to tunnel into the network, deploying an automated recon agent to map internal microservices,” Unit 42 said. “Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords.” The attacker then harvested master administrative credentials and hijacked an enterprise code application to exfiltrate cloud access keys. The stolen cloud keys were then used to turn the victim’s AI endpoints into post-compromise infrastructure.
- A suspected Russian-speaking cyber actor used an AI-assisted workflow to exploit PaperCut NG/MF servers and compromise hundreds of instances. “The campaign extended beyond initial exploitation into a structured post-exploitation pipeline covering Windows credential collection, service-credential harvesting, internal network pivoting, Metasploit automation, and victim packaging,” Hunt.io said.
- A Chinese-speaking threat actor has breached websites belonging to more than 100 companies, including Deere, SharkNinja, and Cummins, using an autonomous penetration testing engine called Cairn, tasking it to probe targets, search for security weaknesses that could lead to code execution or account takeover, attempt to break in, and steal sensitive data.
“AI is serving as a force multiplier and an expanding attack surface at the same time,” Rapid7 said. “Generative AI is accelerating established attack methods by reducing the time, skill, and coordination previously required to execute them at scale.”
“Rather than introducing entirely new categories of exploitation, threat actors are integrating AI into existing workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with greater speed and precision.”
