AI-assisted intruders target Japanese firms and steal credentials
Original title: AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft
TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.
TrendAI examined three exposed attacker servers used against Japanese organizations, with AI ranging from the CyberStrikeAI agent platform to operator-written scripts. Case A validated at least 19 organizations, 16 in Japan, but deep compromise was rare and began at an unauthenticated admin interface. Case B stole hundreds of thousands of cadastral and commercial records plus Windows credentials and email; Case C probed WebLogic and VPN devices. Japan’s National Cybersecurity Office had warned on October 9, 2026, after compromised web systems and stolen personal data.
Unconfirmed: Attacker-side logs do not prove every claimed compromise, and AI use in Case C is high-confidence but unconfirmed by prompts or API keys.
- Case B scanned at least 6,000 Japanese IP addresses and restored backdoors after cleanup.
- Another Case B intrusion used default credentials on a GIS server.
- Case C listed at least 1,300 WebLogic candidates and 35 VPN entry points.
- Yamaha RTX1210 access used credentials from configuration files, not a product flaw.
- Simplified Chinese appeared on all three infrastructures without proving nationality or a shared group.
Impact: Credential theft, web shells, and large record exfiltration
| Product | Affected |
|---|---|
| Yamaha RTX1210 | — |
| Oracle WebLogic | — |
- 1.Patch exposed web systems, require MFA, and restrict privileges, as Japan’s advisory recommends.
- 2.Block uploaded files from executing and monitor database access, per TrendAI guidance.
- ATT&CK
- T1078.001 Default AccountsT1552.001 Credentials In FilesT1505.003 Web ShellT1046 Network Service Discovery
- Organizations
- TrendAINational Cybersecurity Office
- Countries
- Japan
From the original article
3 min read at gbhackers.com
Threat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.