Hackers abused CyberStrikeAI, an open-source penetration-testing platform, to coordinate 44 AI agents that performed network scanning, vulnerability discovery, exploitation, persistence, and data theft.
The activity mainly targeted Japanese organizations and demonstrates how attackers can repurpose legitimate security tools into repeatable intrusion workflows without discovering new vulnerabilities or manually directing every step.
Over a short period in October 2026, the platform probed weaknesses at least 19 organizations, 16 of which were in Japan.
Earlier reporting about CyberStrikeAI being used against FortiGate devices described a separate abuse of the same tool; shared software, however, does not prove the same operators were responsible for both campaigns.
Researchers at TrendAI — Bakuei Matsukawa and Joseph C. Chen — uncovered the malicious activity while analyzing publicly accessible files on attacker-controlled servers. Their October 27, 2026 research report draws a distinction between CyberStrikeAI’s autonomous, multi-agent workflow and other operations that used AI only for planning or scripting. The platform itself is a legitimate testing tool, not a newly identified malware family.
Hackers use CyberStrikeAI agents
The exposed CyberStrikeAI deployment tied together reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, exfiltration, and reporting.
Rather than requiring an operator to move results between standalone tools, the framework assigned tasks to specialized agents and logged their outputs in a database, producing a repeatable process that ran across multiple targets.
One recovered entry — “credential-search agent 8/44” — confirmed a configuration involving 44 agents. Different agents were tasked with searching for credentials, investigating specific vulnerabilities, attempting exploitation, and handling exfiltration.
The platform produced structured reports, generated Japanese-language forms and counterfeit login pages, and provided a management dashboard showing tool execution success rates, token usage, and controls for creating batches of targets. Each target had a consistently formatted report and an evidence index.
These artifacts supported TrendAI’s conclusion that AI orchestrated the workflow rather than simply assisting a human operator with occasional command writing or summarization.
The same multi-agent coordination model has legitimate uses: for example, commercial platforms such as ThreatBook’s multi-agent testing system assemble automated agents for authorized assessments.
In the malicious deployment, agents operated in parallel across multiple organizations while throttling the traffic sent to each target. That distribution made the activity harder to detect from any single victim’s logs.
The clearest intrusion evidence began with an unauthenticated administration interface exposed on a legacy web system; no novel vulnerability was required. Importantly, validation activity did not mean every targeted organization was compromised: many reports explicitly recorded “no session, no web shell, no exfiltration,” and deep compromise affected only a small proportion of targets.
What the evidence means for detection and defense
TrendAI reconstructed the campaign from open directories containing scripts, target lists, logs, command histories, and attack results. The researchers did not have victim-side logs, disk images, or network captures, so their findings show what attackers prepared, attempted, and recorded but cannot independently confirm every claimed success or the full extent of any damage.
Other cases examined by TrendAI illustrate why AI involvement requires careful labeling. In one human-led operation, a large language model helped develop tools and plans while the operator retained direct control; confirmed theft of property records, commercial information, Windows credentials, and email belonged to that separate case, not the CyberStrikeAI deployment.
A different infrastructure displayed signs consistent with AI-assisted scripting, but researchers lacked direct prompts or API keys to prove AI use. Likewise, reports of AI-generated Linux credential-theft scripts separate suspected code generation assistance from autonomous execution—organized comments or emojis in code may support an assessment but do not prove that AI controlled an entire intrusion.
For defenders, practical priorities remain the same: inventory public-facing applications, patch or isolate legacy systems, remove unnecessary administrative interfaces, and replace default credentials. Monitoring should account for low-frequency, distributed attempts. TrendAI also recommends reviewing VPN configurations and exposed AI services, reflecting weaknesses seen across its investigations.
The attackers’ identities, the specific AI models used, and any relationship among the three investigated infrastructures remain unresolved. Simplified Chinese was the working language across the environments, but TrendAI cautions that language alone cannot establish location or affiliation. The central finding is about scale and coordination, not proof of a new state-backed campaign.
Indicators of compromise (IoCs)
| Indicator type | Source disclosure |
|---|---|
| SHA-256, SHA-1, MD5 | Not published |
| Attacker IP addresses | Withheld; dashboard address redacted |
| Malicious domains and URLs | Not published |
| Campaign-specific network indicators | Withheld pending investigations |
Note: IP addresses and domains have been defanged (for example, using [.] in place of dots) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.
