Cybersecurity researchers have uncovered a series of cyberattacks targeting organisations in Japan in which hackers used artificial intelligence to automate hacking activities, identify security weaknesses and steal sensitive information.
One operation involved CyberStrikeAI, an open-source security testing tool that distributed attack tasks among 44 AI agents. The findings from cybersecurity company Trend Micro highlight how criminals are increasingly using AI to conduct complex attacks with less human involvement.
How Were the AI-Powered Cyberattacks Discovered?
Trend Micro examined three separate cyberattack operations involving organisations in Japan and found that artificial intelligence played different roles in each campaign.
Researchers analysed three exposed server environments containing attack tools, scripts, target lists, command histories and other records.
The investigations revealed operations ranging from attacks largely controlled by AI systems to campaigns where human hackers used AI for specific tasks.
Researchers said the available evidence did not establish any connection between the three operators.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
How Did CyberStrikeAI Use 44 AI Agents?
The first operation involved CyberStrikeAI, an open-source penetration testing tool previously associated with attacks targeting FortiGate appliances. The activity was concentrated in October 2026 and involved 44 AI agents performing different stages of cyberattacks.
These agents automated activities including identifying potential targets, discovering vulnerabilities, exploiting weaknesses, maintaining access to compromised systems and extracting information.
The platform also generated reports and created forms and fake login pages in Japanese. Trend Micro found that at least 19 identifiable organisations, including 16 in Japan, had been subjected to validation activity.
Researchers identified structured reports generated by the platform, suggesting that the operations followed an automated process rather than relying entirely on manual instructions.
What Happened in the Other Two Attacks?
The second operation involved a human-led cyberattack supported by a large language model. The attacker allegedly used AI to accelerate planning and develop tools while targeting AI workflow platforms and inference services.
One intrusion involved a geographic information system server protected by default credentials. The attackers reportedly stole land-related records, commercial information, Windows credentials and email data. This campaign continued for 24 days during August and September 2026.
The third operation involved hackers using AI primarily to develop scripts and tools. Researchers linked the activity to at least six campaigns between January and October 2026, targeting exposed VPN devices and WebLogic servers.
The affected technologies included products associated with Cisco, Citrix, F5 and Yamaha.
Were Organisations Outside Japan Also Targeted?
The investigations found that the attacks were not limited to Japanese organisations. The operator behind the CyberStrikeAI campaign also targeted organisations in Taiwan and Hong Kong. Another campaign included organisations in the United Kingdom, France, Italy, Qatar and Colombia in its WebLogic target lists.
However, researchers could not establish whether the three operations shared a common attacker. They also could not determine whether additional regions had been targeted.
How Is AI Changing Cybercrime?
Researchers warned that AI is allowing attackers to conduct more operations simultaneously and reduce the time needed to identify security weaknesses.
Microsoft’s 2026 Digital Defense Report found that AI had reduced the median time between discovering vulnerabilities and developing attacks to less than 24 hours.
In another incident, a China-aligned threat actor identified as Storm-0940 allegedly used an AI-powered framework to automate password-spraying attacks against hundreds of organisations.
The growing availability of AI hacking tools is also reducing the technical expertise required to conduct sophisticated attacks.
The420 Insight: What Does This Mean?
The CyberStrikeAI findings demonstrate how artificial intelligence is becoming part of organised cybercrime operations.
By dividing hacking activities among multiple AI agents, attackers can identify weaknesses, test systems and conduct operations more quickly. The research also highlights the risks associated with exposed servers, weak credentials and unpatched vulnerabilities as AI-powered attacks become increasingly automated.
