Recent reports have unveiled a series of sophisticated cyber attacks targeting organizations in Japan, where artificial intelligence (AI) played a crucial role in augmenting malicious operations. These incidents highlight the growing use of AI in cybercrime, transforming the threat landscape significantly.
AI as a Game Changer in Cybersecurity
Cybersecurity experts from TrendAI have analyzed three compromised server environments that were leveraged by threat actors to carry out these attacks. Unlike previous attacks in South Korea and Japan, these operations utilized AI-driven tools such as ARTEX, an autonomous penetration testing framework. The environments contained reconnaissance tools, attack scripts, and command histories, ranging from manual operator-managed workspaces to fully automated AI-agent platforms.
The first attack demonstrated the use of CyberStrikeAI, an open-source penetration testing tool, which had previously targeted Fortinet FortiGate appliances. The attack unfolded over a concentrated period in October 2026, automating various attack lifecycle stages, from reconnaissance to data exfiltration, using 44 AI agents to streamline tasks and adapt to the Japanese language.
Human-Led Attacks Enhanced by AI
In another case, a human-led attack employed a large language model (LLM) to accelerate planning and tool development. This campaign targeted AI workflow platforms and inference services to gain significant inference capacity at minimal cost. A notable intrusion involved exploiting a GIS server with default credentials, resulting in the theft of sensitive data over a 24-day period in August and September 2026.
The third incident involved AI in a supportive role, aiding in the development of tools and scripts for targeting edge devices from major brands like Cisco and Citrix. This campaign ran opportunistically from January to October 2026, focusing on exposed VPNs and WebLogic servers.
Broader Implications of AI in Cybercrime
These attacks are not confined to Japan; threat actors have also targeted regions such as Taiwan, Hong Kong, and several countries in Europe and the Middle East. The integration of AI into cybercrime has allowed attackers to increase efficiency, enabling them to test vulnerabilities at scale and adapt swiftly to language barriers.
The use of AI in cybercrime is becoming increasingly prevalent, with threat actors automating reconnaissance and decision-making processes. According to Microsoft’s 2026 Digital Defense Report, the time between discovering and exploiting vulnerabilities has drastically reduced to under 24 hours, showcasing AI’s impact.
As AI tools become more accessible, they have opened up new monetization avenues for cybercriminals, facilitating the sale of stolen AI session tokens and offensive tools. This trend further lowers the barrier for executing advanced and persistent attacks, making AI an integral part of modern cybercrime strategies.
In summary, the integration of AI in cybercrime operations is reshaping the threat landscape, offering both opportunities and challenges for security professionals. As AI continues to evolve, its role in cyber attacks is expected to expand, necessitating robust defenses and innovative countermeasures.
