Forty-Four Agents, One Open Admin Page: TrendAI Maps Three Levels of AI in Attacks on Japan

2026-11-02 Agent & Supply Chain Security by al-ice.ai Editorial

In autumn 2026, Japanese companies began reporting a succession of data leaks from their web systems. The National Cybersecurity Office issued an alert to businesses on 9 October, the ruling party cybersecurity chief described cyberspace as being in a state of emergency — and into that atmosphere, TrendAI researchers Bakuei Matsukawa and Joseph C Chen published Not Only ARTEX (Japanese edition 23 October, English edition 27 October 2026), a reconstruction of three attacker infrastructures with a strong Japan focus. Their method is worth noting: they worked from files the attackers left in publicly accessible server directories — open directories holding reconnaissance tools, scripts, target lists, results, logs, and command histories. The three environments range from a workspace largely driven by hand to an AI-agent platform automating the entire workflow including command and control, and they are explicitly distinct from the ARTEX operations covered elsewhere. We read the TrendAI research page and the full Hacker News write-up first-hand.

This site has tracked the ARTEX line closely — the Storm-0940 ConnectWise attribution at machine speed, Vapor Panda running ARTEX espionage at machine scale, and the closed-source ARTEX operator session logs — plus the Sleet AI-adoption tracking that put three North Korean groups at full operational AI use. This briefing does not relitigate those. What is new is the gradation: three infrastructures, three different depths of AI involvement, and a framework for telling them apart.

Case A: the full lifecycle, delegated across 44 agents

The most automated of the three abuses CyberStrikeAI, an open-source penetration-testing tool previously seen in an attack campaign against Fortinet FortiGate appliances. Activity concentrated in a short period in October 2026, and the platform runs the attack lifecycle as a repeatable workflow: reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration, and automated reporting — work delegated across 44 agents, including the generation of Japanese-language forms and fake login pages. In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity. Each had a report in the same format with an index of evidence — outputs of a structured process run by the platform, in Trend Micro enterprise researchers words, not ad hoc notes left by an operator. The operator behind this first case also targeted organizations in Taiwan and Hong Kong, and there is currently no evidence linking the three incidents to a single operator, no visibility into other targeted regions, and no identification of the models used.

Case B: a human operator, an LLM assistant, an inference motive

The second case is human-led, with a large language model accelerating planning and tool development rather than driving execution. Its distinctive feature is target selection: the infrastructure and artifacts indicate a campaign designed to target AI workflow platforms and inference services with the aim of obtaining large amounts of inference capacity at low cost — the demand side of the same stolen-compute economy we traced in the Black October LLMjacking synthesis, where two stolen Bedrock keys burned roughly 2.5 million calls. One intrusion hit a geographic information system server exposed with default credentials, yielding cadastral and commercial records alongside Windows credentials and email data. The campaign ran 24 days across August and September 2026.

Case C: AI confined to the tool shop

In the third instance, AI barely touches the operation at all: its role is confined to developing the operator tools and scripts for campaigns aimed at edge devices from Cisco, Citrix, F5, and Yamaha, using published vulnerabilities, management functions, or credentials sitting in configuration files. The operator is estimated to have run at least six campaigns from January to October 2026, opportunistically striking exposed VPN devices and WebLogic servers — and is described as experienced, with established practices for automation and evidence management. The target lists reach beyond Japan into the U.K., France, Italy, Qatar, and Colombia. TrendAI own summary line is the one defenders should keep: AI has increased the attackers workforce, but the work still consists of looking for unlocked doors. The types of doors have not changed; what changed is the ability to try thousands at once, adapt to the target country language, and continue without fatigue.

Why the gradation matters

The report lands alongside two context points worth carrying. First, Microsoft 2026 Digital Defense Report assessment that AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours — speed that compounds exactly the kind of opportunistic edge-device campaign Case C describes. Second, the monetization layer growing around offensive AI: stolen AI provider session tokens and purpose-built offensive tools with names like APEX AI, MessiahGPT, and DarkGPT, commoditizing advanced tradecraft for buyers who never trained a model. Trend Micro draws the deliberate contrast — frontier models are not the determining factor; access to capable models produces operational gains, but ecosystem depth determines how reliably, independently, and at what scale those gains sustain. And the report keeps its confidence bounds visible: three infrastructures, unknown operators, unknown models, unknown full targeting.

What to do

Grade AI involvement instead of counting agents. Case A, B, and C demand different responses: agent-orchestrated validation at scale, human operations with AI-accelerated tooling and inference theft motives, and conventional edge exploitation with AI-built tools. A single agentic-threat playbook will misfire on at least two of them.
Hunt your own open directories first. All three reconstructions started from attacker infrastructure the operators left publicly readable. Sweep for exposed tooling, logs, and target lists on your own external footprint — and treat any structured, same-format reporting artifacts found during incident response as evidence of platform-driven automation, not manual intrusion.
Close the unlocked doors the agents are trying. Default credentials on a GIS server, exposed VPN devices, published edge vulnerabilities, credentials in configuration files — none of this is novel, which is precisely why 44 agents trying thousands of them is dangerous. The Case C vendor list (Cisco, Citrix, F5, Yamaha) plus WebLogic is a patching order.
Monitor inference capacity like money, because it is. Case B targeted AI workflow platforms for cheap compute, the same resale economy behind the Bedrock key abuse in the Black October synthesis. Spend caps, per-key budgets with hard stops, and alerting on quota-enumeration behavior turn a compute-theft campaign into a paging event.
Localize your phishing models. Japanese-language forms and fake login pages generated as part of the automated workflow mean language-specific lure quality is now a machine output, not a human skill bottleneck. Test defenses against fluent, localized lures rather than the broken-English baseline.

Our verification was read-only: we read the TrendAI deep-research page first-hand, including the autumn-2026 incident context, the 9 October government alert, the open-directory methodology, the three-case structure, and the ecology-versus-frontier-models assessment, plus the complete Hacker News write-up of 27 October 2026 covering all three cases, the CyberStrikeAI workflow details, the GIS intrusion, the edge-device campaigns, the Microsoft Digital Defense Report context, and the offensive-tool monetization layer. We accessed no attacker infrastructure, ran no agentic tooling, and contacted no vendor.

Sources: