Summary
it is an operational component embedded directly into campaigns." The growing demand for AI tools by threat actors has also opened up a new monetizati…
TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX, an autonomous AI penetration testing framework, to single out entities in South Korea and Japan.
"These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control."
The first of the three attacks has been found to abuse CyberStrikeAI, another open-source penetration testing tool that was previously put to use in an attack campaign targeting Fortinet FortiGate appliances. The activity was concentrated in a short period in October 2026.
The AI-driven activity leverages the offensive security tool to automate various aspects of the attack lifecycle into a repeatable workflow, beginning with reconnaissance and vulnerability discovery and validation, and exploitation, to command-and-control (C2), persistence, data exfiltration, and automated reporting.
This involves delegating the work among 44 agents to handle various aspects of the attack, while also enabling the generation of forms and fake login pages in the Japanese language.
"In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity," Trend Micro's enterprise security division said. "Each had a report in the same format and an index of evidence. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator."
The second case has been characterized as a human-led attack with assistance from a large language model (LLM) to accelerate planning and tool development. Analysis of the infrastructure and artifacts indicates that the campaign is also designed to target AI workflow platforms and inference services with an aim to obtain large amounts of inference capacity at low cost.
One of the intrusions is said to have targeted a geographic information system (GIS) server exposed with default credentials, resulting in the theft of cadastral and commercial records, Windows credentials, and email data. The entire campaign lasted for 24 days in August and September 2026.
The third instance is where the AI's role has been found to be confined to developing the operator's tools and scripts, suggesting a limited role played by the technology in a series of campaigns designed to target edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, management functions, or credentials present in configuration files.
The threat actor is estimated to have run at least six campaigns from January to October 2026, opportunistically striking exposed VPN devices and WebLogic servers. "The operator was experienced, with established practices for automation and evidence management," the researchers said.
There is currently no evidence at this stage that suggests these three incidents share an operator. It's also unknown if the attacks have targeted other regions and what AI models are being used to pull off the attacks.
That said, the attacks involving these threat actors are not restricted to Japan and neighboring countries like South Korea. The operator behind the first case has targeted organizations in Taiwan and Hong Kong, while the third case featured organizations in the U.K., France, Italy, Qatar, and Colombia in its WebLogic discovery lists.
"AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors," TrendAI said. "The types of doors and the weaknesses that leave them open have not changed. What has changed is the ability to try thousands at once, adapt to the target country's language, and continue without fatigue."
The development coincides with the discovery of multiple campaigns in which threat actors of varied motivations have integrated agentic AI into existing offensive security workflows, allowing them to speed up research, malware development, social engineering, and other parts of an attack.
To make matters worse, AI is being increasingly used to accelerate reconnaissance, automate decision-making, and industrialize social engineering, shortening the time between exposure and exploitation of security flaws. According to Microsoft's 2026 Digital Defense Report, AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours.
The adoption of AI by bad actors is reducing the time, expertise, and cost required to discover and exploit weaknesses, at the same allowing attackers and defenders alike to operate with greater speed, scale, and autonomy, the Windows maker added.
"The key issue is not simply whether an actor has frontier AI," Trend Micro said. "Access to capable models can already produce meaningful operational gains. Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained."
"AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns."
The growing demand for AI tools by threat actors has also opened up a new monetization avenue that peddles stolen AI provider session tokens and offensive AI tools APEX AI, MessiahGPT, and DarkGPT, further commoditizing cybercrime and lowering the barrier to entry for carrying out advanced, persistent, and evasive attacks.
Last week, Microsoft revealed that a China-state-aligned threat actor compromised a ConnectWise cloud backup application and used ARTEX to sign in to more than 2,250 Microsoft 365 tenants. The activity has been attributed to Storm-0940, which it said has used the framework since as early as September 2026 to automate password-spraying attacks on hundreds of organizations.
"While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time," Microsoft said. "Storm-0940's activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations."
According to local media reports from South Korea, authorities have identified seven suspects linked to a cybercrime operation that broke into more than 90 organizations in the country, most of which involved ARTEX. The 32-year-old mastermind behind the activity is alleged to have worked at a cybersecurity company between 2019 and 2022, gaining expertise in penetration testing.
In 38 of the incidents, the threat actors demanded ransom payments of 360 million won ($270,000) in exchange for not leaking the stolen data. More than 8.2 million records are believed to have been siphoned from compromised organizations.
Some of the other AI-oriented campaigns that have been documented in recent weeks are listed below -
"AI is serving as a force multiplier and an expanding attack surface at the same time," Rapid7 said. "Generative AI is accelerating established attack methods by reducing the time, skill, and coordination previously required to execute them at scale."
"Rather than introducing entirely new categories of exploitation, threat actors are integrating AI into existing workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with greater speed and precision."
Source: The Hacker News
