Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorcriticalExploited in the wild

TrendAI reconstructs three AI-assisted attacks aimed mainly at Japan

4 sources · 6 articlesFirst reported Updated ()1
What's new

October 30 reports cover separate incidents and add no new facts about the three TrendAI cases.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

TrendAI found three separate 2026 operations against Japan; only one was confirmed as driven by CyberStrikeAI agents.

TrendAI, also cited as Trend Micro, reconstructed three exposed attacker servers from 2026 operations aimed mainly at Japan and found no shared operator. In October, open-source CyberStrikeAI coordinated 44 agents that validated at least 19 organizations, 16 in Japan; deep access was rare and the strongest evidence began at an unauthenticated admin interface on a legacy web system. A separate human-led campaign over 24 days in August and September used a large language model, scanned at least 6,000 Japanese addresses, restored backdoors after cleanup, and stole hundreds of thousands of cadastral and commercial records plus Windows credentials and email, including via default GIS credentials. From January to October a third operator ran at least six campaigns and used AI mainly to write tools while probing WebLogic and VPN systems. Yamaha RTX1210 access used configuration-file credentials, not a product flaw. Japan's National Cybersecurity Office warned businesses on October 9; Simplified Chinese on the servers did not prove nationality or one group.

Key facts
  • CyberStrikeAI used 44 agents against at least 19 organizations, 16 in Japan.
  • Deep compromise was rare; many checks left no session, web shell, or theft.
  • A separate August–September campaign stole hundreds of thousands of records.
  • Case C listed at least 1,300 WebLogic candidates and 35 VPN entry points.
  • Yamaha RTX1210 access used configuration-file credentials, not a product flaw.
  • TrendAI lacked victim logs, disk images, and network records.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 9, 2026Japan's National Cybersecurity Office warned businesses. · Security Affairs

What each outlet adds

beyond the shared facts
  • The Hacker NewsLists other country targets and says researchers found no shared operator.
  • GBHackersAdds 6,000 scanned IPs, restored backdoors, WebLogic and VPN counts.
  • Security AffairsSays only one of the three cases was confirmed as agent-driven.
  • Cyber Security NewsNotes a 8/44 agent label and that victim forensics were unavailable.
Vendors
CiscoCitrixF5YamahaOracle
Products
WebLogicFortiGateARTEXCyberStrikeAIPHPRTX1210Cisco SD-WANCitrix NetScalerF5 BIG-IPYamaha RTX1210
Threat actors
Vapor PandaEarth EstriesHollow PandaOvercast PandaTitan PandaVeiled Panda
Malware
ARTEXBLOODALCHEMYShadowPadFlowCloudCyberStrikeAIAPEX AIMessiahGPTDarkGPT
Victims
GMO Internet GroupSony Network CommunicationsIDC FrontierElectricity and Gas Transaction Surveillance Commission
Organizations
CrowdStrikeTrend MicroZscalerMicrosoftMinistry of EconomyTrade and IndustryNational Police AgencyInformation-technology Promotion AgencyTrendAIMacnicaGMO Cybersecurity by IeraeNational Cybersecurity Office
Countries
ChinaUnited StatesBelgiumPhilippinesJapanTaiwanHong KongUnited KingdomFranceItalyQatarColombia
AI models
DeepSeek

Coverage

oldest first · one row per article · UTC
  1. · 3d ago The Hacker NewsFirst report

    CyberStrikeAI’s 44 agents automated attacks on Japan organizations

    Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.

  2. · 2d ago GBHackers

    AI-assisted intruders target Japanese firms and steal credentials

    TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.

  3. · 2d ago Security Affairs

    Trend Micro: three Japan-focused attacks used AI to different degrees

    Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.

  4. · 2d ago Cyber Security News

    Hackers use CyberStrikeAI agents against Japanese organizations

    TrendAI says 44 agents checked at least 19 organizations in October 2026, with deep compromise only in a small share.

  5. · 6h ago GBHackers

    Japan reports a wave of AI-assisted attacks on firms and agencies

    Officials cite data on about 260 million people since April, while leak reports rose from 303 in September to 830 in October.

  6. · 4h ago The Hacker News

    CrowdStrike: Vapor Panda used ARTEX against over 200 organizations

    From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.