Pierluigi Paganini
October 28, 2026
In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling party’s cybersecurity team described cyberspace as being in a “state of emergency.”
Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI. Their findings show three different approaches, ranging from limited AI assistance to systems that use AI agents to manage almost an entire attack.
The researchers looked at files that attackers left on servers anyone could reach. These included attack scripts, lists of targets, logs, and records of commands. The files showed attacks on organizations in Japan and other countries.
But the researchers could not see the victims’ own logs or network records. So they could not confirm every break-in, measure the full damage, or say who was behind it.
Attackers also like to claim more success than they really had. The researchers only counted a result as real when the evidence backed it up.
The three cases show that AI does not play the same role in every cyberattack.
“The cases differ along two dimensions: how much of the attack AI handled and how confidently we can establish its involvement.” reads the report. “Case A used AI to drive the entire workflow, which we confirmed. Case B was human-led, with confirmed AI assistance in planning and tool development. Case C showed high-confidence indications of AI use in a limited role, such as tool development. All three were active in 2026, and much of the activity preceded the previously published ARTEX reports.”
Case A: AI agents managed the attack workflow. The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents. It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process.
The platform split tasks among multiple AI agents. One record mentioned a credential-search agent in a system that used 44 agents. The platform could also generate Japanese content, including forms and fake login pages.
Researchers identified at least 19 target organizations, including at least 16 in Japan. The system worked on several targets at once and kept traffic to each organization relatively low. This made the activity harder to detect by checking the logs of a single victim.
Despite this automation, the platform rarely gained deep access to target systems. In many cases, it had no active session or web shell and showed no evidence of stolen data. The clearest intrusion started through an administration page that was publicly accessible on an old web system. The attackers did not need to exploit a newly discovered vulnerability.
Case B: A human attacker used AI to plan and build tools. In this case, the operator made the main decisions but used a large language model to speed up planning and tool development. The researchers found an attack plan written by an LLM that targeted services providing AI and GPU resources.
The attacker presented requests as authorized security testing to get around the model’s safety limits. The researchers say this was a false claim, although they did not publish the exact method.
The attacker also targeted AI infrastructure, including platforms for AI workflows, data processing and model inference. The researchers believe the goal may have been to gain access to computing resources that could be used to run AI models cheaply.
Some intrusions had serious consequences. In one case, the attacker gained control across several systems, including an FTP service, a database, an administrator account, a web shell and SSH access. The attacker also restored backdoors after they had been removed.
In another case, a geographic information system server was exposed with default credentials. This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data. The evidence confirmed that information was downloaded.
However, the researchers found no evidence that AI carried out these attacks independently. It helped the operator plan and build tools, while the actual work relied mainly on scripts, existing software and human decisions.
Case C: AI played a limited role. Here, the operator appears to have used AI mainly to develop tools and scripts. The researchers found no evidence that it was involved in planning or managing the wider operation. They rated AI involvement as highly likely, but not confirmed, because they found no direct evidence such as prompts or API keys.
The operator ran at least six campaigns in 2026, targeting exposed VPN devices and Oracle WebLogic servers. The targets included devices from Cisco, Citrix, F5 and Yamaha.
In attacks against Yamaha RTX1210 routers, the operator did not exploit a product vulnerability. Instead, the attacker used credentials found in configuration files. These credentials provided direct access to internal corporate networks.
The researchers also found signs that AI may have helped write some commands and scripts. These included unusually structured comments and emoji used as status markers. Such clues can support an assessment, but they cannot prove AI use on their own.
Japan was the main target in all three operations, but attackers also targeted other countries and regions. All three used Simplified Chinese, but this does not prove they came from the same group or location.
“Simplified Chinese was the working language in all three infrastructures. Japan was the largest target country, although the operators also pursued nearby countries and regions. Entry points were exposed legacy systems or weaknesses left in default configurations.” concludes the report. “Target selection was opportunistic across industries: the operators sought systems that were easy to attack from outside and acted on what they found.”
The main difference was how AI was used. In one case, AI agents managed much of the attack and worked on many targets at once. In another, AI helped a human plan attacks and build tools. In the third, AI was mainly used to develop tools.
AI helped make attacks faster and easier to scale, but attackers still exploited familiar weaknesses, such as outdated web systems, exposed admin pages, default passwords and poorly secured network devices. Researchers also found that AI tools sometimes reported planned actions as successful, making it essential to verify their results.
AI can also help defenders discover vulnerabilities. However, researchers found no evidence that these three operations used AI-discovered zero-day flaws. Their attacks relied on known vulnerabilities and poor security settings.
The report identifies six main priorities for defenders:
These security weaknesses existed long before AI became widely available. AI simply helps attackers find and exploit them faster and across more systems.
The time between discovering a vulnerability and using it in an attack may also become shorter. Organizations should install security updates quickly and apply temporary protections when patches are not available.
Researchers still don’t know who was behind the three operations, whether they were connected or how much damage they caused. Further reports may provide more answers.
“The attackers’ identities, whether the three cases share an operator, the full scale of the damage, and the AI models used remain unresolved. Our observations come from attacker-side files and still require confirmation from the affected organizations.” concludes the report. “We are considering further technical reporting on individual cases: AI-driven activity in Case A, AI assistance in Case B, and limited AI assistance in Case C. We will also continue working with the relevant organizations.”
The main lesson is clear: AI can make cyberattacks faster and larger, but the basic security priorities remain the same. Organizations must identify systems exposed to the internet, strengthen access controls and detect suspicious activity before attackers turn a simple weakness into a serious breach.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Italy)
