TrendAI: three attack infrastructures aimed at Japan show different levels of AI use, from a 44-agent CyberStrikeAI setup that ran validation activity against at least 19 organisations to human-led intrusions
TrendAI (Trend Micro) published research on 27 October 2026 (English edition) describing three attack infrastructures, rebuilt from exposed open directories, that targeted Japan with different levels of AI use.
In Case A, TrendAI says a CyberStrikeAI setup with a Simplified Chinese console split work across 44 agents (reconnaissance, vulnerability search, exploitation and exfiltration), and at least 19 identifiable organisations, including at least 16 in Japan, were subjected to validation activity in October 2026; TrendAI says deep compromise was limited. In Case B, a human-led operator used LLM help, targeted AI and GPU services and, through a GIS server with default credentials, reached several hundred thousand cadastral and commercial records over about 24 days in August and September.
Case C made limited use of AI and ran at least six campaigns from January to October against Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210 devices and WebLogic servers.
TrendAI says it does not know whether the cases share an operator, withheld indicators of compromise and plans to provide its results to law enforcement.
The Hacker News reported the research on 27 Oct.
- Product
- Internet-facing systems in Japan, including Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210 and WebLogic
- Versions
- n/a — threat research
- Exploited in Australia?
- unknown
- Patch to
- Patch and restrict internet exposure of edge devices named by TrendAI (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210, WebLogic) and change default credentials on internet-facing servers such as GIS servers.