Trend Micro Says Three Attack Platforms Aimed at Japan Used AI in Very Different Ways, From a 44-Agent Autonomous Harness to Tidy Scripts, Yet Each Got In Through Old Exposed Systems and Leftover Credentials

TOKYO - As Japanese companies and local bodies disclose a string of data leaks from their websites this fall, the explanation most often heard is that attackers are now using AI. Trend Micro says that is true, but that the phrase hides more than it explains.

In a report published in Japanese on Friday, Trend Micro staff researcher Joseph C Chen and principal threat researcher Hirohide Matsukawa describe three attack platforms, each a full server setup with tools, target lists, results and command histories, that the operators had left exposed in open directories. All three focused on Japan, all three operators worked in Simplified Chinese, and each used AI to a very different degree. The researchers say the platforms are separate from the ARTEX activity that GMO Cybersecurity by Ierae reported on Oct. 19 and CrowdStrike tied to attacks on South Korean finance on Oct. 7, and that much of the activity began before those reports.

Their conclusion is blunt. AI raised the scale and speed of the attacks, the researchers write, but the attackers were still looking for unlocked doors.

Case A: the autonomous harness

The first platform ran CyberStrikeAI, an open-source agent-based penetration testing tool whose exposed console uses Simplified Chinese. Reconnaissance, vulnerability checks, exploitation, command and control, persistence, exfiltration and automatic report writing ran as one repeatable workflow, split among many agents. A log entry reading "agent 8/44" for credential discovery let Trend Micro confirm a 44-agent design. The platform also produced Japanese-language forms and fake login pages on its own.

In a short burst in October 2026 it tested at least 19 organizations, at least 16 of them in Japan, along with targets in Taiwan and Hong Kong, leaving an identically formatted report and evidence index for each. It kept contact with any single target infrequent, which Trend Micro says would make the activity hard to spot from one organization's logs.

Most of those tests went nowhere. For many targets the platform itself recorded no session, no web shell and no exfiltration. Even in the one case with the clearest intrusion chain, the way in was an unauthenticated, publicly reachable admin screen on an old web system.

Case B: a human crew with a chatbot

The second operator ran the attack and used a large language model as a tool for planning and building. Over about 24 days in August and September, the crew scanned more than 6,000 Japanese IP addresses and focused on a handful of companies. Output files showed the model drafting plans to attack AI and GPU services, and Trend Micro confirmed the operator had told the model the work was authorized testing, a false premise meant to get past its safeguards.

AI services were also targets. The crew's lists included AI workflow platforms, LLM preprocessing systems and inference services, and it had built tools to hijack and pool other people's access to AI services, which the researchers infer was a way to obtain cheap inference at volume. Hundreds of attempts to break into one cluster all ended in errors.

Against old web systems, the damage was real. At one company the crew built a full chain from FTP to the database, administrator rights, a web shell and SSH, and restored its back doors after they were cleaned up. At another it used a GIS server still running default credentials to take hundreds of thousands of cadastral and commercial records, Windows credentials and email.

Case C: an expert with AI-written scripts

The third operator was the most experienced: organized directories, logs, evidence and success lists for each campaign, plus an independent check to weed out false positives. From January to October 2026 this operator ran at least six campaigns, in parallel from September, against more than 1,300 WebLogic candidates and more than 35 VPN entry points. Targeted edge devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP and Yamaha RTX1210 routers, which are widely used in Japan. For the RTX1210s, the operator did not need a product flaw: credentials left in configuration files it had obtained connected it straight into corporate networks. WebLogic target lists also named organizations in Britain, France, Italy, Qatar and Colombia, though Trend Micro says most of those were scan results, not confirmed breaches.

Trend Micro rates AI involvement here as high confidence rather than confirmed, because it found no prompts or API keys. Command histories annotated each step with section headers in the style of echo '=== ... ===', and a cleanup-check script used emoji status markers and neat section comments, patterns the researchers associate with code written by current language models.

What defenders can do

Trend Micro did not publish indicators, saying it will give them to law enforcement and is preparing to notify organizations that may have been affected. Directory names such as jp_success, jp_attack and jp_cve_attack show the operators organized their work around Japan, but the researchers say it is not known whether the three cases share an operator. Their priorities for defenders:

• Inventory public web systems and update or isolate old ones.
• Check for default credentials and admin screens exposed to the internet.
• Review VPN and edge device configuration and look for reused or leftover credentials.
• Check whether in-house AI services, including inference, workflow and GPU platforms, are reachable from outside.
• Design monitoring for low-frequency probing spread across many organizations.
• Where staff use LLMs at work, prepare for misuse framed as legitimate requests.

The researchers add that in these cases the AI tools tended to log planned steps as completed and to grade their own results too optimistically, so self-reported success in attacker files should not be taken at face value.