Trend Micro: three Japan-focused attacks used AI to different degrees
Original title: Three Japan-Focused Cyberattacks Show How Hackers Use AI
Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.
Trend Micro examined attacker files left on reachable servers from three 2026 operations that mainly targeted Japan. Case A used the open-source CyberStrikeAI agent platform across reconnaissance, checks, exploitation and theft, with at least 19 organizations identified and limited deep access. Case B was human-led with LLM help for planning and tools, including confirmed downloads from a GIS server. Case C likely used AI only for scripts while hitting exposed VPN gear and Oracle WebLogic.
Unconfirmed: Researchers could not confirm every intrusion, full damage, or who operated the infrastructure.
- Japan's National Cybersecurity Office warned businesses on October 9.
- Case A split work across agents; one record cited a 44-agent system.
- A GIS server with default credentials exposed hundreds of thousands of records.
- Yamaha RTX1210 access used credentials from configuration files, not a product flaw.
- All three infrastructures used Simplified Chinese, which does not prove one group.
Impact: Network access and theft of land, business and email data
| Product | Affected |
|---|---|
| Yamaha RTX1210 | — |
| Oracle WebLogic | — |
| Cisco VPN devices | — |
| Citrix VPN devices | — |
| F5 VPN devices | — |
- 1.Close publicly exposed administration pages on legacy web systems.
- 2.Replace default credentials and secrets stored in device configuration files.
- 3.Check for web shells and backdoors restored after removal.
- Products
- CyberStrikeAIRTX1210WebLogic
- Organizations
- Trend MicroNational Cybersecurity Office
- Countries
- Japan
From the original article
6 min read at securityaffairs.com
Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key. In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.