Red Team

Exposed attacker servers show 44-agent AI kit automating intrusions

TrendAI found three attacker setups using AI, one running CyberStrikeAI with 44 agents, all getting in through old, exposed and misconfigured systems.

Target motif with the headline 'AI agents automate the hunt for unlocked doors' and the label AI TRADECRAFT

Researchers studied three attacker servers left open to the internet and found AI working at every level, from writing scripts to running a 44-agent intrusion platform on its own. The way in was still the same as ever: unpatched, forgotten and badly configured systems facing the internet.

What happened

On 27 October 2026 TrendAI, the enterprise arm of Trend Micro, published an English version of research by Bakuei Matsukawa and Joseph C Chen, first released in Japanese on 23 October. The pair pieced together three separate operations aimed mainly at Japanese organisations, using open directories on the attackers’ own servers that exposed their tools, target lists, logs, shell histories and generated reports.

The research comes during a bad autumn for Japan. After a run of web system data leaks, the National Cybersecurity Office warned businesses on 9 October, and the ruling party’s cyber security chief, Masaaki Taira, said Japan was in a state of emergency in cyberspace. ITPro reports that Macnica counted 119 attacks by 6 October, against 86 in all of 2025.

TrendAI says the three operations are separate from previously reported ARTEX activity. All three worked in Simplified Chinese, which the researchers call a weak clue, and they make no attribution.

The technical picture

The value of the report is that it ranks AI involvement by how much of the attack AI did and how strong the evidence is, rather than treating “AI attack” as one thing.

Case A is the headline. The operator ran CyberStrikeAI, an open-source AI penetration testing platform written in Go. Team Cymru tied it to the FortiGate mass-compromise actor in March, BleepingComputer reported. Here it ran the whole kill chain as one repeatable workflow, from reconnaissance and exploitation through command and control, persistence, exfiltration and reporting. A log entry, “credential-search agent 8/44”, shows the work was shared across 44 agents. It generated Japanese forms and fake login pages, and throttled traffic so no single victim saw much. At least 19 organisations, 16 in Japan, were probed in a short October burst.

The detail I would show any board is the platform’s own scorecard. For many targets it logged no session, no web shell and no exfiltration. Deep compromise was confirmed for only a few, and even the best intrusion began at an unauthenticated admin page on an old web system. No new vulnerability was needed.

Case B was human-led. An LLM drafted attack plans and helped build tools after the operator falsely claimed to be running an authorised assessment. More than 6,000 Japanese IP addresses were scanned, but only one or two firms were hit hard. One suffered a full chain from FTP to SSH, with backdoors restored after cleanup. At another, a GIS server still on default credentials gave up several hundred thousand land and commercial records. The operator also targeted exposed inference services and GPU clusters, apparently for cheap compute, TrendAI infers.

Case C was a methodical operator who apparently used AI only for tooling, judged from neat banners in shell histories and emoji in scripts. TrendAI calls that high confidence, not confirmed. Six or more campaigns between January and October targeted edge kit from Cisco, Citrix, F5 and Yamaha, plus over 1,300 candidate Oracle WebLogic servers. The Yamaha routers fell to credentials lifted from configuration files, not a flaw.

Summary graphic of TrendAI's three cases: a 44-agent CyberStrikeAI platform, a human-led LLM-assisted operation and an operator using AI-written tooling against edge devices

Why it matters for UK organisations

The UK link is small. The UK appears in Case C’s WebLogic discovery lists, together with France, Italy, Qatar and Colombia. TrendAI says those entries came from broad scanning. They show a system was listed, not compromised. Nothing here suggests a campaign against British targets.

The report still matters on this side of the North Sea, because nothing in it is specific to Japan except the language of the phishing pages. The products in Case C are standard in UK estates. The weaknesses that let all three operators in are ones we find on almost every external test: admin panels exposed to the internet, default passwords, legacy applications nobody owns, and secrets left in configuration backups. An operator who can point 44 agents at an address range does not care which country it is in.

The throttling in Case A is the part that should worry SOC teams. If the probing is spread thinly over hundreds of organisations, each one sees only a few odd requests, well below any alert threshold. You only see the pattern when the data is pooled, which is a strong argument for sharing threat intelligence through sector bodies and the NCSC rather than relying on your own logs.

Expert view

TrendAI puts it well: AI has given attackers a bigger workforce, “but the work still consists of looking for unlocked doors.” That matches what I see. When we run external assessments, the findings that lead to real compromise are rarely clever. They are the forgotten staging server, the vendor appliance still on its install password, the VPN profile with a stored credential. What AI changes is how cheap it is to check every one of them, all at once, without tiring.

There is a useful point for defenders in the self-reporting too. The platform logged its own failures honestly. TrendAI also notes that AI-generated self-assessments can record success before an action has even been attempted, and that LLMs in general sometimes cite vulnerability IDs that do not exist. Automated attackers that trust their own output can be steered towards decoys and honeypots more easily than a careful human.

Case B’s jailbreak is a reminder for anyone who runs internal LLM tools. “This is an authorised test” is the oldest social engineering line in our trade, and it still works on machines. The finding that operators were also hunting exposed inference endpoints and GPU clusters should push AI platforms into the asset register if they are not already there.

What to do now

  1. Find every internet-facing web system, especially legacy ones, and retire it, patch it or put it behind access controls. Unauthenticated admin interfaces should not be reachable from the internet (Cyber Essentials: firewalls, secure configuration).
  2. Remove default and shared credentials from servers, GIS platforms and appliances, and enforce MFA on admin access (user access control).
  3. Audit VPN and edge devices from Cisco, Citrix, F5 and others: confirm they are patched to current releases and check configuration backups for stored secrets (security update management).
  4. Inventory AI infrastructure, including inference endpoints, workflow tools and GPU environments, and confirm none are exposed without authentication.
  5. Tune detection for low-and-slow activity: look at the pattern across your external estate over time, not at single spikes, and share indicators with your sector and the NCSC.
  6. Brief anyone running internal LLM services that false “authorised assessment” framing is being used to get round guardrails, and log those requests.

Bottom line

This is one of the most grounded looks yet at how criminals actually use AI. The answer is three different ways, with one fully automated platform among them, and all of them still depending on the basics being missed. The UK was only scanned in passing. The lesson is still universal: automation makes basic security gaps cheaper to find at scale, so closing them is now urgent.

Sources

Related Posts