Hackers use CyberStrikeAI agents against Japanese organizations
Original title: Hackers Use CyberStrikeAI Agents to Automate Network Scanning, Exploitation, and Data Theft
TrendAI says 44 agents checked at least 19 organizations in October 2026, with deep compromise only in a small share.
Attackers abused CyberStrikeAI, an open-source penetration-testing platform, to coordinate 44 agents for scanning, exploitation attempts, persistence, and data theft. TrendAI reconstructed the work from open directories on attacker servers and said activity in October 2026 mainly involved Japanese targets. No new vulnerability was used; the strongest evidence started at an exposed unauthenticated admin interface on a legacy web system. Many reports recorded no session, web shell, or exfiltration.
Unconfirmed: Attacker identities, models, links among three infrastructures, and every claimed success are unconfirmed.
- At least 19 organizations were checked, including 16 in Japan.
- A recovered entry was labeled “credential-search agent 8/44.”
- TrendAI had no victim logs, disk images, or network records.
- Theft confirmed in a separate human-led case was not this operation.
- IP addresses, domains, and file hashes were withheld.
Impact: Scanning, attempted exploitation, persistence, and possible theft
- 1.Inventory public-facing apps and patch or isolate legacy systems.
- 2.Remove unneeded admin interfaces and replace default credentials.
- 3.Review VPN settings and exposed AI services.
- ATT&CK
- T1046 Network Service DiscoveryT1190 Exploit Public-Facing ApplicationT1552 Unsecured CredentialsT1041 Exfiltration Over C2 Channel
- Products
- CyberStrikeAI
- Organizations
- TrendAI
- Countries
- Japan
From the original article
3 min read at cybersecuritynews.com
Hackers have abused CyberStrikeAI, an open-source penetration-testing platform, to coordinate 44 AI agents across network scanning, exploitation, persistence, and data theft. The activity primarily targeted Japanese organizations, showing how attackers can turn security tools into repeatable intrusion workflows without developing new vulnerabilities or manually directing every task.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.