AI-driven intrusions against Japan, including a 44-agent CyberStrikeAI workflow

What happened

• TrendAI (formerly Trend Micro enterprise) describes three cases. Case A: the open-source CyberStrikeAI tool, apparently configured with 44 agents (inferred from an “8/44” label), validated and exploited at least 19 organizations, at least 16 in Japan, mostly in October 2026. Case B: a GIS server with default credentials gave access to several hundred thousand cadastral and commercial records over 24 days (Aug to Sep). Case C: a likely AI-assisted toolkit hit Cisco, Citrix, F5 and Yamaha edge devices and WebLogic from January to October.
• Techniques: default credentials, published edge-device vulnerabilities, credentials in config files; no CVEs named.
• Attribution: none. TrendAI says Simplified Chinese as a working language is “only a weak clue” and does not know if the cases share an operator.

Sources

• https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan
• https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.