Kyles Investigation is a Tennessee Licensed Private Investigator #5411.
SUBMIT A JOB

CyberStrikeAI and 44 Agents: What TrendAI Found in Japan

An army of 44 autonomous AI agents deployed in a coordinated cyber campaign targeting organizations across Japan.

Oct 27, 2026 · @Mark

TrendAI’s look at three exposed attacker environments shows AI used at three very different levels, and only one of the three used CyberStrikeAI to coordinate 44 agents.

The three cases

TrendAI studied three exposed server environments used against organizations in Japan, and it has no evidence that one operator ran all three.

1. CyberStrikeAI

What AI did: Automated the whole attack workflow, split across 44 agents

Targets: At least 19 organizations, at least 16 in Japan; the operator also hit Taiwan and Hong Kong

Timing:  A short window in October 2026

2. Human-led, LLM-assisted

What AI did:  Sped up planning and tool development

Targets: Included a GIS server with default credentials; the setup also aimed at AI workflow platforms and inference services 

Timing: 24 days, August to September 2026

3. Tool-building only 

What AI did: Helped write the operator’s own tools and scripts

Targets:  Cisco, Citrix, F5 and Yamaha edge devices, plus WebLogic servers

Timing:  At least six campaigns, January to October 2026

The 44-agent case

In the first environment, CyberStrikeAI, an open-source penetration-testing tool, turned the attack lifecycle into a repeatable workflow handled by 44 agents.

The workflow covered reconnaissance, finding and validating vulnerabilities, exploitation, command and control, persistence, data theft and automated reporting. It could also generate forms and fake login pages in Japanese. CyberStrikeAI had already shown up in an earlier campaign against Fortinet FortiGate appliances, so this is not its first use in attacks.

The scale is easy to overstate, so it helps to read the numbers carefully. TrendAI counted at least 19 organizations that went through validation activity, and each had a report in the same format with an index of evidence. That points to a structured process run by the platform rather than an operator’s loose notes. Validation activity is not the same as a confirmed breach, and the findings as relayed here do not say how many of the 19 were actually compromised.

TrendAI also could not say which AI models powered the agents.

What changed and what did not

The other two cases are the useful counterweight: AI is everywhere in the picture, but the entry points are old ones.

In the second case, a person led the attack and used an LLM to plan and build tools. One intrusion reached a GIS server left exposed with default credentials and took cadastral and commercial records, Windows credentials and email data. In the third, AI only helped write the operator’s tooling, while the operator worked through known vulnerabilities, exposed management functions and credentials sitting in configuration files. TrendAI called that operator experienced, with settled habits for automation and evidence handling.

TrendAI’s own summary is that attackers are still “looking for unlocked doors.” What AI changed is the volume of doors tried at once, the ability to adapt to the target country’s language, and the lack of fatigue.

Two more caveats. The report does not say the three operators are connected, and it does not say how far these campaigns reach beyond Japan, though the first operator also touched Taiwan and Hong Kong and the third operator’s WebLogic target lists included the UK, France, Italy, Qatar and Colombia.

What defenders can do

These are my takeaways, not TrendAI’s recommendations, and each ties to a weakness seen in the cases.

  • Remove default credentials. The GIS server breach started with them, and attackers can now test thousands of such doors at once.
  • Patch and shrink the exposed edge. VPN devices, management interfaces and WebLogic servers were the targets in the third case, reached through published flaws.
  • Keep secrets out of configuration files. Stored credentials were one of the routes into the edge devices.
  • Inventory your AI endpoints and agents. One campaign was built to hijack exposed AI workflow platforms and inference services, apparently to get inference capacity cheaply.
  • Plan for volume. Machine-paced probing across many services at once is a pattern worth alerting on, instead of waiting for a single known indicator.

Sources

Leave a Reply