A wave of data leaks from Japanese web systems in autumn 2026 has sharpened concern over AI’s role in cyberattacks on Japan. The National Cybersecurity Office alerted businesses on October 9, and the chair of the ruling party’s cybersecurity headquarters said cyberspace was in a “state of emergency.”
Researchers reconstructed three attack infrastructures from files left in attackers’ open directories. All three are separate from those in earlier reports on ARTEX, an autonomous AI penetration-testing system.
AI’s role varied widely. Without victim-side logs, the findings cannot confirm each attempt’s success, the full damage, or the attackers’ identities. Victims are described only by count, industry, size, and country.
Case A: Automated Cyberattacks on Japan
In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like “credential-search agent 8/44” show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages.
It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read “no session, no web shell, no exfiltration.” The deepest intrusion began at an unauthenticated administration interface on a legacy system.
Case B: Human-Led, AI-Assisted
Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model’s guardrails. Other tools sought to hijack and pool access to other people’s AI services, likely to get cheap inference capacity.
One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed.
Case C: Limited AI Role
From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia.
Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks.
Section headings such as echo ‘=== … ===’ in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded.
Lessons Beyond ARTEX
All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin.
AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs.
These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases.
Defending Against Cyberattacks on Japan
Recommended steps:
- Inventory public-facing systems and update or isolate legacy ones.
- Remove exposed default credentials and admin interfaces.
- Secure VPN and edge-device configurations against credential reuse.
- Check internal AI and GPU services for exposure.
- Monitor for low-frequency, distributed attempts.
- Prepare for LLM misuse through requests built on false premises.
Fast patching and virtual patching matter more as the time between disclosure and exploitation shrinks. The attackers’ identities, the AI models used, and the full damage remain unknown.
