Trend Micro reports AI driven cyber campaigns targeting Japan

Trend AI researchers have disclosed three Japanese-targeted cyber campaigns where AI played a central role, either driving operations or aiding operators. The first campaign uses CyberStrikeAI, an open‑source penetration tool, deployed to automate the full attack lifecycle—from recon and vulnerability validation to exploitation, C2, persistence, data exfiltration and automated reporting—across 44 AI agents.

Trend Micro notes the activity ran for a short window in October 2026 and involved the generation of forms and fake login pages in Japanese. Trend Micro’s TrendAI group reports at least 19 identifiable organisations were subjected to validation activity, with 16 located in Japan; every target produced a standardised report and evidence index, implying a structured, platform‑driven workflow rather than scattered operator notes.

The second case is described as human‑led with AI assistance from a large language model to accelerate planning and tool development, with the campaign also seeking to monetise AI workflow platforms and inference services. One intrusion reportedly targeted a GIS server with default credentials, stealing cadastral and commercial records, Windows credentials and emails, in a campaign lasting 24 days in August–September 2026.

The third instance confines AI to developing operator tools and scripts, targeting edge devices from Cisco, Citrix, F5 and Yamaha via published vulnerabilities or configuration data. Across January to October 2026, the actor conducted at least six campaigns, including exposed VPNs and WebLogic servers. The evidence suggests the first actor targets Taiwan and Hong Kong as well; the others include campaigns in the U.K., France, Italy, Qatar and Colombia. The researchers emphasise that AI acts as a force multiplier but does not alter the fundamental approach of seeking unlocked doors.