Cybersecurity researchers have disclosed detailed findings regarding three distinct cyber attacks targeting organizations in Japan, where artificial intelligence served as a central element—either acting in the driving seat or assisting human operators. These revelations shed light on the evolving tactics of modern threat actors who are increasingly embedding agentic AI frameworks into their malicious operations.
The analysis was conducted by TrendAI, which examined three exposed server environments utilized by threat actors to execute their malicious cyber campaigns. According to security researchers Bakuei Matsukawa and Joseph C. Chen, these environments were distinct from previously published attacks that have leveraged ARTEX, an autonomous AI penetration testing framework used to single out entities in South Korea and Japan.
The exposed servers contained an array of reconnaissance and attack tools, scripts, target lists, operational results, logs, and command histories. The researchers noted that the setups ranged from workspaces used largely by hand by skilled operators to fully automated AI-agent platforms capable of handling the entire attack workflow, including command and control operations.
The first of the three analyzed attacks was found to abuse CyberStrikeAI, an open-source penetration testing tool previously deployed in an attack campaign targeting Fortinet FortiGate appliances. This specific activity was concentrated within a brief period in October 2026. The AI-driven activity leverages the offensive security tool to automate various stages of the attack lifecycle into a repeatable, streamlined workflow. This begins with reconnaissance, vulnerability discovery, and validation, moving through exploitation, command-and-control establishment, persistence, data exfiltration, and automated reporting.
This automated process involves distributing tasks among 44 distinct agents to handle various operational requirements, while also dynamically generating localized forms and fake login pages in the Japanese language. Trend Micro’s enterprise security division reported that within a short period, at least 19 identifiable organizations, including at least 16 located in Japan, were subjected to validation activity. Each targeted entity had a report generated in a uniform format accompanied by an index of evidence, marking them as the outputs of a structured, platform-driven process rather than ad hoc notes left behind by a human operator.
The second case identified by researchers has been characterized as a human-led attack supported by a large language model to accelerate strategic planning and tool development. An analysis of the infrastructure and operational artifacts indicated that this campaign was specifically designed to target AI workflow platforms and inference services. The ultimate objective of this campaign was to acquire large amounts of inference capacity at a minimal cost.
One specific intrusion in this campaign targeted a geographic information system server that had been left exposed with default credentials, resulting in the theft of valuable cadastral and commercial records, Windows credentials, and internal email data. This particular campaign spanned 24 days across August and September 2026.
The third instance featured a more limited role for artificial intelligence, which was confined primarily to developing the operator’s custom tools and scripts. This campaign was part of a series of operations designed to target edge devices from major vendors such as Cisco, Citrix, F5, and Yamaha by exploiting publicly disclosed vulnerabilities, exposed management functions, or credentials left unprotected in configuration files.
The threat actor behind these operations is estimated to have executed at least six distinct campaigns between January and October 2026, opportunistically striking exposed virtual private network devices and WebLogic servers. Researchers noted that the operator was highly experienced, possessing established practices for automation and evidence management.
Currently, there is no evidence to suggest that these three distinct incidents share a common operator. Furthermore, it remains unknown whether these campaigns have targeted other geographical regions or precisely which underlying AI models were utilized to orchestrate the attacks. However, the operational footprints extend beyond Japan and neighboring South Korea. The threat actor behind the first case also targeted organizations in Taiwan and Hong Kong, while the third case included organizations in the United Kingdom, France, Italy, Qatar, and Colombia within its WebLogic discovery lists.
TrendAI emphasized that while artificial intelligence has effectively increased the workforce size for attackers, the fundamental nature of cyber intrusions remains unchanged. Attackers are still looking for unlocked doors, and the types of vulnerabilities that leave systems exposed have not fundamentally shifted. What has changed, however, is the capability to test thousands of targets simultaneously, dynamically adapt to the target country’s language, and execute operations continuously without fatigue.
This trend coincides with the discovery of multiple campaigns in which threat actors with varied motivations have integrated agentic AI into existing offensive security workflows. This integration allows malicious actors to accelerate research, malware development, social engineering, and other phases of the cyber kill chain. Security reports from major industry players indicate that AI is systematically reducing the time, technical expertise, and financial cost required to discover and exploit security weaknesses.
According to Microsoft’s Digital Defense Report, the median time from vulnerability discovery to weaponization has collapsed to well below 24 hours due to automated, AI-driven processes. The adoption of these technologies by bad actors allows both attackers and defenders to operate with greater speed, scale, and autonomy. Trend Micro noted that the key issue is not merely whether an adversary possesses a frontier AI model, but rather how ecosystem depth determines the reliability, independence, and scale at which those capabilities can be sustained. Artificial intelligence is no longer viewed as an experimental capability for advanced persistent threat groups, but rather as an operational component embedded directly into active campaigns.
The surging demand for specialized AI tools among threat actors has simultaneously opened up new monetization avenues within the cybercrime underground. Illicit markets now regularly peddle stolen AI provider session tokens alongside offensive AI tools such as APEX AI, MessiahGPT, and DarkGPT. This trend further commoditizes cybercrime and lowers the technical barrier to entry for executing advanced, persistent, and evasive operations.
These findings arrive on the heels of other major disclosures. Microsoft recently revealed that a China-state-aligned threat actor compromised a ConnectWise cloud backup application and used the ARTEX framework to sign in to more than 2,250 Microsoft 365 tenants. This activity was attributed to a group tracked as Storm-0940, which has utilized the framework since September 2026 to automate password-spraying attacks against hundreds of organizations. Although the majority of the targeting was unsuccessful, the group successfully achieved privileged cloud persistence at numerous organizations in a brief timeframe, illustrating the disruptive potential of agentic AI tools combined with privileged authentication materials.
Meanwhile, law enforcement authorities in South Korea have identified seven suspects linked to a widespread cybercrime operation that breached more than 90 organizations in the country, largely relying on the ARTEX framework. The 32-year-old mastermind behind the operation is alleged to have previously worked at a cybersecurity firm, where specialized expertise in penetration testing was acquired. In at least 38 of these incidents, the threat actors issued ransom demands equivalent to $270,000 to prevent the publication of stolen data, with more than 8.2 million records estimated to have been siphoned from compromised entities.
Security analysts at Rapid7 noted that artificial intelligence is simultaneously acting as a force multiplier and an expanding attack surface. Generative AI is accelerating established attack methods by reducing the time, skill, and coordination previously required to execute large-scale operations. Rather than introducing entirely new categories of exploitation, threat actors are systematically integrating AI into existing workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with unprecedented speed and precision.
