CyberStrikeAI Deploys 44 Agents for Structured Attacks on 19 Japanese Targets in October 2026

Trend Micro researchers Bakuei Matsukawa and Joseph C Chen examined three exposed server environments containing reconnaissance tools, target lists, logs, and command histories. The first environment ran CyberStrikeAI to handle reconnaissance, vulnerability validation, exploitation, C2, persistence, exfiltration, and Japanese-language phishing page generation across 19 entities. Outputs included standardized evidence indexes rather than operator notes, confirming repeatable AI-driven workflows distinct from prior ARTEX campaigns in South Korea and Japan.

The second and third environments showed hybrid and limited AI use: one leveraged LLMs for planning and tool development targeting GIS servers and AI inference capacity theft over 24 days in August-September 2026, while the third confined AI to script development for edge device exploits against Cisco, Citrix, F5, and Yamaha devices across six campaigns from January to October 2026. No shared operators were identified, yet activity extended to Taiwan, Hong Kong, UK, France, Italy, Qatar, and Colombia.

These cases illustrate AI scaling attacker capacity without replacing core tactics of scanning for misconfigurations and default credentials. National security risks rise as AI agents enable rapid, multi-region operations against critical infrastructure and commercial data, while businesses face accelerated reconnaissance that outpaces manual detection. Procurement records and incident reports show increasing open-source offensive tools repurposed this way.

Independent technical evidence from server artifacts confirms AI automation but lacks attribution to state actors. Expect expanded monitoring of AI workflow platforms and inference services as targets.