Cybersecurity researchers have disclosed particulars of three cyber assaults concentrating on organizations in Japan through which synthetic intelligence (AI) was a key ingredient, both within the driving seat or to help a human operator.
TrendAI, which analyzed three uncovered server environments utilized by menace actors to conduct the malicious cyber operations, described them as distinct from beforehand revealed assaults which have leveraged ARTEX, an autonomous AI penetration testing framework, to single out entities in South Korea and Japan.
“These environments held reconnaissance and assault instruments, scripts, goal lists, outcomes, logs, and command histories,” safety researchers Bakuei Matsukawa and Joseph C Chen mentioned. “They ranged from workspaces used largely by hand by expert operators to AI-agent platforms that automated the whole workflow, together with command and management.”
The primary of the three assaults has been discovered to abuse CyberStrikeAI, one other open-source penetration testing device that was beforehand put to make use of in an assault marketing campaign concentrating on Fortinet FortiGate home equipment. The exercise was concentrated in a brief interval in October 2026.
The AI-driven exercise leverages the offensive safety device to automate varied facets of the assault lifecycle right into a repeatable workflow, starting with reconnaissance and vulnerability discovery and validation, and exploitation, to command-and-control (C2), persistence, knowledge exfiltration, and automatic reporting.
This entails delegating the work amongst 44 brokers to deal with varied facets of the assault, whereas additionally enabling the era of varieties and pretend login pages within the Japanese language.
“In a brief interval, not less than 19 identifiable organizations, together with not less than 16 in Japan, have been subjected to validation exercise,” Development Micro’s enterprise safety division mentioned. “Every had a report in the identical format and an index of proof. These have been outputs of a structured course of run by the platform, reasonably than advert hoc notes left by an operator.”
The second case has been characterised as a human-led assault with help from a big language mannequin (LLM) to speed up planning and gear growth. Evaluation of the infrastructure and artifacts signifies that the marketing campaign can also be designed to focus on AI workflow platforms and inference providers with an purpose to acquire giant quantities of inference capability at low price.
One of many intrusions is alleged to have focused a geographic info system (GIS) server uncovered with default credentials, ensuing within the theft of cadastral and business data, Home windows credentials, and electronic mail knowledge. All the marketing campaign lasted for twenty-four days in August and September 2026.
The third occasion is the place the AI’s function has been discovered to be confined to creating the operator’s instruments and scripts, suggesting a restricted function performed by the expertise in a sequence of campaigns designed to focus on edge units from Cisco, Citrix, F5, and Yamaha utilizing revealed vulnerabilities, administration features, or credentials current in configuration information.
The menace actor is estimated to have run not less than six campaigns from January to October 2026, opportunistically hanging uncovered VPN units and WebLogic servers. “The operator was skilled, with established practices for automation and proof administration,” the researchers mentioned.
There may be at the moment no proof at this stage that implies these three incidents share an operator. It is also unknown if the assaults have focused different areas and what AI fashions are getting used to drag off the assaults.
That mentioned, the assaults involving these menace actors aren’t restricted to Japan and neighboring nations like South Korea. The operator behind the primary case has focused organizations in Taiwan and Hong Kong, whereas the third case featured organizations within the U.Ok., France, Italy, Qatar, and Colombia in its WebLogic discovery lists.
“AI has elevated the attackers’ workforce, however the work nonetheless consists of searching for unlocked doorways,” TrendAI mentioned. “The kinds of doorways and the weaknesses that depart them open haven’t modified. What has modified is the flexibility to strive hundreds directly, adapt to the goal nation’s language, and proceed with out fatigue.”
The event coincides with the invention of a number of campaigns through which menace actors of various motivations have built-in agentic AI into current offensive safety workflows, permitting them to pace up analysis, malware growth, social engineering, and different components of an assault.
To make issues worse, AI is being more and more used to speed up reconnaissance, automate decision-making, and industrialize social engineering, shortening the time between publicity and exploitation of safety flaws. In keeping with Microsoft’s 2026 Digital Protection Report, AI has collapsed the median time from vulnerability discovery to weaponization to effectively beneath 24 hours.
The adoption of AI by dangerous actors is lowering the time, experience, and value required to find and exploit weaknesses, on the identical permitting attackers and defenders alike to function with higher pace, scale, and autonomy, the Home windows maker added.
“The important thing challenge shouldn’t be merely whether or not an actor has frontier AI,” Development Micro mentioned. “Entry to succesful fashions can already produce significant operational features. Ecosystem depth, nevertheless, determines how reliably, independently, and at what scale these capabilities will be sustained.”
“AI is not an experimental functionality for APT teams; it’s an operational element embedded immediately into campaigns.”
The rising demand for AI instruments by menace actors has additionally opened up a brand new monetization avenue that peddles stolen AI supplier session tokens and offensive AI instruments APEX AI, MessiahGPT, and DarkGPT, additional commoditizing cybercrime and decreasing the barrier to entry for finishing up superior, persistent, and evasive assaults.
Final week, Microsoft revealed {that a} China-state-aligned menace actor compromised a ConnectWise cloud backup software and used ARTEX to register to greater than 2,250 Microsoft 365 tenants. The exercise has been attributed to Storm-0940, which it mentioned has used the framework since as early as September 2026 to automate password-spraying assaults on tons of of organizations.
“Whereas nearly all of the concentrating on wasn’t profitable, Storm-0940 achieved privileged cloud persistence at many organizations in a quick time,” Microsoft mentioned. “Storm-0940’s exercise illustrates how a menace actor with a broad goal set can use an agentic AI device and privileged authentication materials to rapidly try and compromise many organizations.”
In keeping with native media reviews from South Korea, authorities have recognized seven suspects linked to a cybercrime operation that broke into greater than 90 organizations within the nation, most of which concerned ARTEX. The 32-year-old mastermind behind the exercise is alleged to have labored at a cybersecurity firm between 2019 and 2022, gaining experience in penetration testing.
In 38 of the incidents, the menace actors demanded ransom funds of 360 million gained ($270,000) in alternate for not leaking the stolen knowledge. Greater than 8.2 million data are believed to have been siphoned from compromised organizations.
Among the different AI-oriented campaigns which have been documented in current weeks are listed beneath –
-
A financially-motivated menace actor working beneath the deal with
BUGSTER
configured the
Hermes Agent framework
with
DeepSeek V4
as its reasoning engine and Cursor as a secondary device (each with security controls disabled) to run a WordPress brute-force marketing campaign in opposition to an Indian college’s web site and generate a REST API enumeration report.- The attacker additionally breached a second Indian public college, exfiltrating a database of greater than 5,200 data, together with personally identifiable info (PII) on college students. A 3rd assault enumerated an Indian web site on a preferred e-commerce platform to extract a storefront API token, admin electronic mail addresses, telephone numbers, and cost service provider IDs.
- “The actor additionally constructed specialised AI bot profiles to amass VoIP fraud experience by dialog and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., figuring out giant cryptocurrency holders),” Palo Alto Networks Unit 42 mentioned. “Notably, the Wi-Fi cracking functionality requires shut bodily proximity to the goal, indicating the actor had native entry to the focused places.”
- An e-crime group named CyberCartel has been noticed utilizing a multi-agent system known as CARLIY0S to coordinate assaults in opposition to banks and cost suppliers throughout Latin America. The framework employs a cognitive swarm comprising 4 role-specialized Claude fashions that “debate every goal and defer to 1 arbiter” earlier than the principle orchestrator acts. “The group assigned completely different roles to business AI fashions to research targets, develop assaults, and coordinate operations,” Straiker mentioned.
- Menace actors have developed an offensive AI agent designed to hijack uncovered AI endpoints to run autonomous assaults, with directions permitting it to hold out as much as 100,000 steps with out human approval whereas the reliable proprietor of the uncovered endpoint pays for the inference. The system includes a malicious loop known as Skynet mode that employs a set of 74 instruments to scan for targets, infect them, deploy cryptocurrency miners, and reinfect compromised hosts.
- An affiliate for the The Gents ransomware operation has used Anthropic Claude Code throughout intrusions into not less than six organizations in late June 2026, together with to generate and execute reconnaissance and exploitation instructions, write malicious scripts, modify firewall insurance policies, and determine high-value enterprise programs.
- A credential-harvesting operation codenamed Zerofot constructed a scanner named “auto_scan” that built-in OpenAI Codex and Claude Code to reap hundreds of API keys and tokens from hundreds of uncovered hosts throughout the web.
- An AI-generated Python framework known as RAGE has been used to scan internet-facing providers (e.g., Redis, Elasticsearch, Docker, Apache Tomcat, Jenkins, Hadoop YARN, Confluence, and Supervisord), exploit weak deployments, seize credentials, and deploy cryptocurrency miners.
- A human operator employed frontier AI fashions to breach an enterprise community autonomously over a 10-hour interval. “The actor breached a publicly accessible internet service to tunnel into the community, deploying an automatic recon agent to map inside microservices,” Unit 42 mentioned. “Sub-agents combed enterprise code repositories, extracting hard-coded tokens and repair passwords.” The attacker then harvested grasp administrative credentials and hijacked an enterprise code software to exfiltrate cloud entry keys. The stolen cloud keys have been then used to show the sufferer’s AI endpoints into post-compromise infrastructure.
- A suspected Russian-speaking cyber actor used an AI-assisted workflow to use PaperCut NG/MF servers and compromise tons of of situations. “The marketing campaign prolonged past preliminary exploitation right into a structured post-exploitation pipeline overlaying Home windows credential assortment, service-credential harvesting, inside community pivoting, Metasploit automation, and sufferer packaging,” Hunt.io mentioned.
- A Chinese language-speaking menace actor has breached web sites belonging to greater than 100 corporations, together with Deere, SharkNinja, and Cummins, utilizing an autonomous penetration testing engine known as Cairn, tasking it to probe targets, seek for safety weaknesses that might result in code execution or account takeover, try to interrupt in, and steal delicate knowledge.
“AI is serving as a drive multiplier and an increasing assault floor on the identical time,” Rapid7 mentioned. “Generative AI is accelerating established assault strategies by lowering the time, talent, and coordination beforehand required to execute them at scale.”
“Reasonably than introducing totally new classes of exploitation, menace actors are integrating AI into current workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with higher pace and precision.”
