CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published
Three cyber attacks targeting organizations in Japan utilized artificial intelligence (AI) to varying degrees, according to cybersecurity researchers. The TrendAI analysis of server environments used by threat actors revealed these attacks as distinct from previous ones that leveraged ARTEX, an autonomous AI penetration testing framework.
The attacks encompassed reconnaissance, attack tools, scripts, target lists, results, logs, and command histories. One attack, CyberStrikeAI, was an open-source penetration testing tool that was abused to automate various aspects of the attack lifecycle, delegating tasks to 44 agents. At least 19 organizations, including 16 in Japan, were subjected to validation activity in a short period in October 2026.
The second attack involved human-led efforts with assistance from a large language model (LLM) to accelerate planning and tool development, targeting AI workflow platforms and inference services. The third attack saw the AI's role confined to developing the operator's tools and scripts. These campaigns, spanning multiple months, involved various countries and aimed to strike exposed VPN devices and WebLogic servers.
The adoption of AI has significantly increased the attackers' workforce and capabilities, reducing the time and cost required to discover and exploit security flaws.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
