1,000 servers suspected of powering AI-driven cyberattacks identified worldwide

An international investigation, led by Japan, has discovered that approximately 1,000 servers were being used to launch sophisticated AI-powered cyberattacks globally, beginning in October. The servers, according to the Japan Computer Emergency Response Team Coordination Centre (JPCERT/CC), may have been utilizing AI tools to identify potential system vulnerabilities and target websites worldwide.

The investigation, conducted in collaboration with overseas cybersecurity firms, identified AI tools installed on the servers and is currently monitoring between 600 and 700 of them. Most of the servers were hosting AI-powered platforms, such as Artex, a tool used for penetration testing, which was designed to assess system security.

Investigators suspect these platforms were used to search for vulnerabilities and steal system configuration files. One server contained traces of a programming support tool developed by US-based AI company Anthropic, indicating that attackers might have utilized AI to enhance their hacking abilities. Some servers also hosted tools capable of analyzing the internal structure of smartphone applications and software, as well as programs designed to test system vulnerabilities.

Attackers were believed to have examined applications and attempted unauthorized access through interfaces used to exchange information with external systems. The findings underscore how advanced AI is lowering the technical barriers to cybercrime, making hacking activities more accessible to those with less specialized knowledge.

Analyst Ken Sajo of JPCERT/CC warned that the threat could worsen as criminals become more adept at exploiting AI capabilities. "As AI is still in the early stages of being used for cyberattacks, more sophisticated attacks will increase in the future," he cautioned.