In October 2026, 44 agents hit 16 Japanese targets

In a short stretch of October 2026, an attack platform built on the open-source tool CyberStrikeAI ran validation against at least 19 identifiable organizations, 16 of them in Japan. Each target got a report in the same format with an indexed set of evidence. Trend Micro’s TrendAI team, which pulled the detail from three exposed attacker server environments, read those uniform reports as the tell: they were outputs of a structured process, not notes an operator left by hand.

The platform delegated the work across 44 agents covering the full lifecycle: reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration, and the reporting at the end. It also generated forms and fake login pages in Japanese. An earlier run of the same tool went after Fortinet FortiGate appliances.

That first case was the most autonomous of the three. The second was human-led with an LLM speeding up planning and tool development, and it had a specific appetite: AI workflow platforms and inference services, the aim being large amounts of inference capacity at low cost. One intrusion hit a GIS server exposed with default credentials and left with cadastral and commercial records, Windows credentials, and email data over 24 days across August and September. The third kept AI in a narrow lane, writing the operator’s tools and scripts while the human went after edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, exposed management functions, or credentials sitting in config files. That operator ran at least six campaigns from January to October, picking off exposed VPN devices and WebLogic servers.

Trend Micro found no evidence the three share an operator, and it does not know which AI models are involved. None of the three stayed inside Japan: the first case also hit Taiwan and Hong Kong, and the third had UK, French, Italian, Qatari, and Colombian organizations in its WebLogic discovery lists.

TrendAI described the shift this way: “AI has increased the attackers’ workforce, but the work still consists of looking for unlocked doors. The types of doors and the weaknesses that leave them open have not changed. What has changed is the ability to try thousands at once, adapt to the target country’s language, and continue without fatigue.”

That sizing holds up. A GIS server with default credentials, a VPN device running a published CVE, a token left in a config file: none of those are new, and none of them needed 44 agents. What the agents buy is throughput and reach. One operator can now validate 19 organizations with identical rigor and file a report for each, in the local language, without getting bored or sloppy on target 15.

For anyone defending exposed infrastructure, the consequence that matters is timing. Microsoft’s 2026 Digital Defense Report puts the median time from vulnerability discovery to weaponization well below 24 hours. The buffer you used to get between a disclosure and someone actually scanning you for it is mostly gone. The same edge classes keep showing up across these campaigns, Fortinet, Cisco, Citrix, F5, Yamaha, plus WebLogic and VPN concentrators, so that is where the patch clock counts most.

The work being automated is boring and known. Kill default credentials on anything internet-facing, starting with management and GIS interfaces. Get secrets out of config files that an exploited box will hand straight over. Treat your exposed edge inventory as a live target list, because that is how it is being used, and shorten the window between a vendor advisory and your own patch to hours rather than weeks.

Trend Micro’s other point is about durability. “The key issue is not simply whether an actor has frontier AI,” it said. “Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained.” The 44-agent platform, with its templated reporting and evidence indexing, is what that depth looks like in practice.

---

#ad Contains an affiliate link.