44 AI agents and a Japanese target list: inside the AI attack platforms aimed at Japan in 2026

Three attacker servers, analysed by TrendAI and published on 27 October, show what AI-driven attacks on Japan look like from the attacker's side. On one server, the open-source platform CyberStrikeAI split the work among 44 agents and put at least 16 organisations in Japan through what TrendAI calls validation. On the other two, a human ran the attack and used AI to plan it or to write the tools. In the same week, Microsoft tied the ARTEX framework to a China-aligned actor that tried to sign in to more than 2,250 Microsoft 365 tenants, and Seoul police arrested a ring that used ARTEX against about 90 organisations. This article, first published on 20 October as a question about ARTEX, now sets all of that out. One thing has not changed: no source ties any tool to the twelve Japanese breaches we profiled.

What changed since 24 October

The attacker's side is now visible. TrendAI's researchers Bakuei Matsukawa and Joseph C. Chen examined three exposed environments holding tools, scripts, target lists, results, logs and command histories. They describe them as separate from the ARTEX attacks already reported in Korea and Japan.
ARTEX has a named state-aligned user. Microsoft says Storm-0940, which it calls a China-state aligned actor, has used ARTEX since as early as September 2026, and that it was behind the ConnectWise Cloud Backup supply-chain compromise.
ARTEX has a criminal user in court. Seoul Metropolitan Police announced on 26 October that seven people had been caught over intrusions at about 90 organisations and 8.2 million stolen records; the leader used ARTEX.
CyberStrikeAI was already on JPCERT/CC's list. Its 23 October update named Cairn, CyberStrikeAI and ARTEX among the AI penetration-testing platforms abused in attack attempts in Japan. TrendAI's report now describes one of those platforms in use.

Our assessment. AI is now a working part of attacks on Japan, from writing exploit scripts to running whole campaigns. The doors it goes through are the ones defenders already know: internet-facing management pages, default passwords, credentials left in configuration files, flawed site functions and over-trusted vendor apps. TrendAI's own summary: "AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors."

Three attacker servers aimed at Japan

TrendAI graded the three cases by how much of the work the AI did. We could not open TrendAI's report from our build environment; the details below come from two independent summaries of it, The Hacker News and a DEV Community write-up, and we mark where only one of them carries a detail.

Case	AI's role	When	Targets	How they got in	What was taken or produced
1. CyberStrikeAI	Ran the workflow: 44 agents from reconnaissance through C2, persistence, exfiltration and reporting	A short period in October 2026	At least 19 identifiable organisations, at least 16 in Japan; the operator also targeted Taiwan and Hong Kong	Validation of exposed weaknesses; Japanese-language forms and fake login pages	A report in the same format and an evidence index for each organisation
2. Human-led, AI-assisted	A language model sped up planning and tool development	24 days in August and September 2026	AI workflow platforms and inference services, for cheap inference; a GIS server	The GIS server was exposed with default credentials	Cadastral and commercial records, Windows credentials and email data from the GIS intrusion
3. Human-led, AI-built tools	AI wrote the operator's tools and scripts only	At least six campaigns, January to October 2026	Edge devices from Cisco, Citrix, F5 and Yamaha; exposed VPN devices and WebLogic servers. Its WebLogic lists also held organisations in the UK, France, Italy, Qatar and Colombia	Published vulnerabilities, management functions, and credentials found in configuration files	Not stated in the summaries

"Validation" is not "breach". In case 1 the platform checked whether each weakness was real and recorded evidence. The DEV write-up says most attempts failed, that the platform throttled its traffic to each target, and that the deepest intrusion began at an administration page of a legacy public web system that needed no login. It also says TrendAI found the AI's own records overconfident, logging actions as done before they were tried. Those three details appear only in that write-up.
No shared operator. TrendAI found no evidence that the three cases share an operator and could not tell which AI models were used.
The Yamaha detail. One summary says the Yamaha intrusions used no product vulnerability at all, only credentials taken from configuration files the operator already held. Yamaha's RTX routers are common in small Japanese offices, so this is the kind of door the case-3 operator found useful.
What TrendAI had said before. On 12 October TrendAI wrote that it had not established a connection between the recent incidents in Japan and the use of AI by attackers. The new report shows AI-driven targeting of Japan; it does not name victims or link them to disclosed breaches.

CyberStrikeAI: what the public code shows

We cloned the public repository on 28 October and read it; we ran none of it. CyberStrikeAI is an Apache-2.0 project written in Go. Its first commit is dated 8 November 2025 under the name Ed1s0nZ, and the code now refers to the AIPentest organisation as its home. Version 1.7.24 was current on 28 October.

What it is built to do. Multi-agent orchestration in single-agent, plan-and-execute and supervisor modes; 90 tool recipes that wrap scanners such as nmap, nuclei and sqlmap; a knowledge base; WebShell management; and a built-in C2 with listeners, encrypted beacons and task queues. Operators can drive it from chat apps including Telegram, WeChat and Slack. Its README says to use it only on authorised systems.
Its skills read like an attacker's checklist. The bundled initial-access-phishing skill lists password spraying, adversary-in-the-middle phishing that defeats MFA, device-code phishing and OAuth consent phishing against Microsoft 365. The unlimited-attack-scope skill tells the agent, in Chinese, "if blocked, change route; do not stop until done".
44 agents is not the default. The repository has shipped 16 agent definitions in every version from 1.7.18 (mid-September) to 1.7.24. The 44 agents TrendAI counted point to an operator who built a larger configuration, or to a different way of counting; the summaries do not say which.
Its safety rule does not cover Japan. Since 8 September a default rule blocks tool calls aimed at government domains. We ran the rule's pattern, copied from the source, against sample hostnames. It blocks .gov, gov.cn, gov.uk and gov.kr, but not Japan's go.jp (central government), lg.jp (local government), ac.jp or ed.jp (education). Any operator can also switch the rule off. The case-1 targets were mostly small businesses and local public bodies, according to the DEV summary; the default rule would not have stopped the platform at a Japanese town hall.
It has been used before. Amazon reported in February that a Russian-speaking, financially motivated actor used commercial AI services to break into more than 600 FortiGate devices in over 55 countries between 11 January and 18 February 2026, through exposed management ports and weak passwords rather than any FortiGate flaw. Team Cymru then found CyberStrikeAI running on one of the servers Amazon published, and counted 21 addresses running it between 20 January and 26 February, mostly hosted in China, Singapore and Hong Kong. Team Cymru assesses that the developer has some ties to the Chinese government; that is its assessment, not an established fact. Amazon's report

ARTEX: a state-aligned user and a criminal ring

ARTEX is the open-source multi-agent penetration-testing system published by the GitHub account Autumn-27. Its first release was on 26 July 2026; on 8 October the developer said updates would stop and the project would go closed-source. piyolog (Japanese) CrowdStrike reported on 7 October that an unknown, probably Chinese-speaking actor used it with language models against South Korean financial firms. CrowdStrike Two new reports add two more users.

Storm-0940 (Microsoft, 21 October). We read Microsoft's report directly. Microsoft

Microsoft says Storm-0940 used ARTEX "as early as September 2026" against hundreds of organisations in sectors from defence and semiconductors to think tanks, and reached privileged cloud access in some within three hours of first targeting.
Between 10 and 14 October one address, 144.172.64[.]99, sprayed passwords at 327 accounts in eight organisations: more than 151,000 failed sign-ins, a peak of 2,900 a minute on 11 October, and nearly 98% lockout responses. None succeeded.
After taking control of the identities of several ConnectWise cloud apps, the actor's agents used the apps' existing trust to sign in to customer tenants without any user sign-in, and attempted more than 2,250 tenants. In some they read the directory, added credentials to apps, changed roles (one app made itself Global Administrator) and read Azure Key Vault secrets at scale. Microsoft's verdict: "While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time."
Microsoft says ARTEX's interface can be switched to Japanese, and that it has seen threat actors "across multiple geographic regions" using the framework. It does not name Japanese victims.
Two of the user agents Microsoft lists, python-requests/2.34.2 and curl/7.88.1, are the same strings JPCERT/CC listed in its case B. Both are generic clients; the match is a reason to look, not a link between the campaigns.

The Seoul ring (police announcement, 26 October). Korean media report that Seoul Metropolitan Police caught seven people who took about 8.2 million personal records from about 90 organisations, including affiliates of large companies, hospitals and universities, and demanded a total of KRW 360 million in cryptocurrency from 38 of them. The 32-year-old leader was not an IT graduate; he did security-check work at a security company and taught himself the rest. Police say he used ARTEX, and that they used AI themselves to analyse attack times, methods and addresses. The case began with a victim's complaint in June. Hankook Ilbo (Korean) · SBS (Korean) · News1 (Korean)

The ring is older than ARTEX. Reports put the start of its activity in September 2025, ten months before ARTEX's first release. ARTEX can explain only the later part of its work. The same caution applies in Japan: a wave that began before a tool existed cannot be blamed on that tool alone.
It is not the CrowdStrike actor. CrowdStrike's actor hit Korean banks; the Seoul ring is a different group. At least three unrelated actors have now used ARTEX, so knowing the tool does not identify the attacker.

How much did the AI do?

The reports describe very different levels of automation. We placed six 2026 cases on one scale, using each source's own description of the AI's role.

Figure 1. Six 2026 cases by the AI's share of the work. Original graphic from the sources named in each card.

Beyond Japan and Korea, the pattern repeats. The table lists the other agent-driven campaigns reported in the last two months, with how firm the evidence is.

Reported	Who reported	What the AI did	Scale	Evidence
19 Oct	NorForge, via Dark Reading	A Chinese-speaking operator ran the Cairn engine, one of the three platforms JPCERT/CC names	More than 1,200 sites attempted, tied to over 100 companies; Reuters named Deere, SharkNinja and Cummins	Attacker dashboards; how much data was taken is unknown
21 Oct	Straiker, via Runtime Wire	A harness called CARLIY0S, built on the open-source PentAGI, gave Claude, Grok and Kimi models separate roles	More than 400 Latin American financial targets	Attacker files; targets, not confirmed breaches. Anthropic blocked the account
21 Oct	Symantec, via Infosecurity Magazine	A "Skynet mode" agent hijacks exposed model endpoints and runs up to 100,000 steps with about 74 tools, then mines Monero	Caught in a honeypot	No confirmed compromise
Sep–Oct	GreyNoise, with Hunt.io	Agents built on the Codex harness and a DeepSeek model exploited PaperCut NG/MF and packaged each victim	440 instances at 395 organisations in 48 countries	Vendor telemetry and exposed attacker directories
Sep	Unit 42	A human directed agents that mapped a network, raided code repositories and took root credentials	One enterprise, breached in under 10 hours with more than 50 ATT&CK techniques	Incident response
2026	Unit 42	A DeepSeek model, through the Hermes Agent framework, acted as the operator	About 460 targets; three confirmed compromises of Citrix NetScaler through CVE-2026-3055	Incident response

Reported, but not verified by us. Summaries of these reports also mention an actor called BUGSTER attacking Indian universities, a credential harvester called Zerofot, a framework called RAGE, a ransomware affiliate's use of Claude Code, and underground tools sold as APEX AI, MessiahGPT and DarkGPT. We could not find the original publications for Zerofot, RAGE or those tool names, and the counts for the others differ between outlets, so we leave them out of the table.
Speed is the common thread. Microsoft's 2026 Digital Defense Report, as reported by Help Net Security, puts the median time from a vulnerability's discovery to its weaponisation at well below 24 hours. We could not open the full report to check the wording.

What Japan's responders say about the attacks here

JPCERT/CC, 8 October, updated 23 October. Alert JPCERT-AT-2026-0030 describes case A, scanning each target for many different known flaws; case B, analysing public smartphone apps to find APIs and keys and then attacking internal APIs the app's screens never call, by switching headers on and off, sending malformed tokens and using blind NoSQL injection; and, since 23 October, case E, attack attempts that abuse AI penetration-testing platforms such as Cairn, CyberStrikeAI and ARTEX against web applications, configuration and backup files, and internet-exposed WSUS servers. Case B now also lists access through Tor exits and residential proxies and a user agent identical to the genuine app. JPCERT/CC (Japanese)
Macnica, 7 October. Macnica counted 119 web-system breaches disclosed in Japan in 2026 by 6 October, 81 of them after July. It describes attackers who survey a whole site and test its functions and access rules by trial and error, against targets down to library catalogues. It found no log that proves AI was used, but argues that this per-site exploration at this scale would be hard for humans alone. Macnica (Japanese)
NICT, 13 October. The "A2B" alert warns that AI could speed up the analysis of apps to reach their servers. NICT has not attributed any company's breach to the pattern. NICT (Japanese)

One address links the published lists. JPCERT/CC's case E lists 38.244.50[.]120, which CrowdStrike reported as the host of an ARTEX instance and open directory in the Korean campaign. That is a shared address in the reporting. It does not show who controlled it at each time, and JPCERT/CC gives no observation period for it. JPCERT/CC also publishes JA3 93c7d42c0df602fb91589311534831f5 and JA4 t13d181100_85036bcba153_d41ae481755e, and says the JA4 is shared with ordinary Python HTTP clients; treat both as correlation fields, not proof of an agent.

Download the ten IP entries added to cases B and E on 23 October. The file keeps the advisory's context and dates; it is a transcription, not an attribution or a tested detection rule. No address was contacted.

The twelve Japanese breaches: still a hypothesis

In our first version we profiled every direct attack in our breach tracker against what an agent like ARTEX would leave in a company's own notice. The test and the twelve results stand; the new reports do not change any row.

Test	What we look for in the company's own notice
1. After release	Access began on or after 26 July 2026, the date of ARTEX v0.1.0
2. App, API or site flaw	A site function, API or specification abused (our route “app-api”), or a flaw in the company's web application (“web-flaw”)
3. The company's own system	The company's own internet-facing service, not a supplier's platform, stolen credentials or ransomware
4. Mechanical traces	The notice mentions volume, repetition, re-entry after blocking, or mechanical access

We applied the tests to the 28 direct attacks among the 87 notices in our tracker, which is complete for notices disclosed from 9 October 2026 and selective before that.

Not confirmed. These organisations disclosed breaches that match all three tests. That is consistent with an AI penetration-testing agent. It is not evidence that ARTEX, CyberStrikeAI or any AI was used against them, and none of them has said so.

Organisation	Access (from the notice)	Route in the notice	Mechanical traces	Scale
IDARE (Fivot)	10 Aug – 27 Sep	A flaw in third-party customer-support software; the database read repeatedly	Repeated reads over seven weeks	129,659 people
Lawson ID	12–17 Sep	The app's mechanism bypassed to reach account data	Not stated	2,155,345 accounts
777CON-PASS (Sammy Networks)	From 25 Sep; source blocked 30 Sep	Requests that returned user and hall data; fixed by changing the specification	Found through an abnormal rise in access volume	Under investigation
Studio	30 Sep – 1 Oct	A vulnerability in some of the site builder's functions; decryption keys among the exposed data	Not stated	All registered customers possibly affected
skyticket, route 1 (Adventure)	2–4 Oct	Admin functions misused to reach other servers and cloud data	A separate page was read by machine for two months (route 3)	About 14.64 million records
infoQ (GMO Research & AI)	From 2 Oct; found 3 Oct	A vulnerability in the member site	Not stated	948,498 member records
Fancl and Attenir	3–10 Oct	A function of the online shops, since switched off	Not stated	785,496 people
Commune	5–7 Oct	A flaw that exposed invite links; the attacker then posed as community admins	Came back through a leftover route during maintenance	About 307,000 people
Resort Trust	5 Oct, 20:30–23:30	Abnormal operation of the booking site; vulnerability fixed	A three-hour burst	About 62,000 records
Baitoru (dip)	6 Oct	A flaw in the specification of a site function, from overseas	Not stated	Up to 3,885,771 email addresses
Coconala	8 Oct	A vulnerability in the skill marketplace	Blocked at 02:05, back at about 13:00, data out by about 15:00	2,294 files
SourceNext	9–13 Oct	A member-information API misused	Not stated	Up to 22,519,960 records

Disclaimer. This table shows only a possibility. Inclusion means that a company's own notice matches the profile we tested; it does not mean the company was affected by ARTEX, CyberStrikeAI, another AI tool, or the same attacker. No company listed here, and no regulator, CERT or police force, has said that an AI tool was used against it. Each row reflects that company's notice as of 19 October 2026. If you represent a listed organisation and have information that changes this assessment, contact us and we will correct the row and note the change below.

Figure 2. The twelve access windows against the dated events about AI attack tools. Original graphic.

What the twelve have in common. Almost none needed a widely known vulnerability. The notices describe functions doing what they were built to do for someone who should not have been allowed: an API returning other people's data, a specification that let a request through, an invite link that should have stayed private, admin features reachable from outside. That is the per-site flaw that used to be rare because each site had to be studied by hand, and it is what an agent with a recording proxy is designed to grind through.

Partial fits and the ones that do not fit.

Fit the route but not the start date: Seicomart app, Nippon Rent-a-Car app, MrMax and Aena. Aena's notice attributes the breach to mechanical, continuous access, the strongest trace of automation in any notice we hold.
Route not disclosed: Burger King Japan, Yakiniku King, Bookoff, Beauty Garage, Daiki Suisan, Comic Seymour, M3, Medley and Arcadia's SpeeCAN RAIDEN.
Do not fit: Nikkei's development cloud (stolen credentials); IDC Frontier's cloud (ransomware); ACCESS's Taiwanese subsidiary, entered through a BI tool by a scripted exploit of a known Metabase flaw, which matches JPCERT/CC's case C.
Supplier breaches (59 notices from the customers of Commune, IDC Frontier, Studio and Arcadia) are counted once, at the supplier.

Why the twelve remain unattributed

TrendAI names no victims. Case 1 put at least 16 Japanese organisations through validation in October, the same month as most of the twelve. Validation is not a breach, and neither summary links any target to a disclosed incident.
The tools are shared. ARTEX now has at least three unrelated users; CyberStrikeAI is public and has been used since January. Knowing the tool would not identify the attacker even if a notice named it.
A published address is not a victim link. 38.244.50[.]120 appears in both JPCERT/CC's and CrowdStrike's lists, with no period and no tie to any of the twelve.
The rise started before ARTEX. Macnica's count turns sharply upward in July; ARTEX's first release was on 26 July, and the Seoul ring was active from September 2025.
Generic tooling. curl and python-requests appear in JPCERT/CC's case B, in Microsoft's Storm-0940 indicators and in ordinary scripts.
The same work can be done by people. The profile describes a class of attacker, not one product.

The attacker's playbook

How the platforms in these reports work against a Japanese organisation, mapped to MITRE ATT&CK. This is a model built from the public descriptions, not a reconstruction of any one case.

Step	What it looks like	ATT&CK
Equip	Stand up an agent platform on a rented server and connect a language model; CyberStrikeAI or ARTEX, with dozens of agents	T1583.003 Virtual Private Server; T1588.007 Artificial Intelligence
Find doors	Sweep for management pages, edge-device logins, WebLogic consoles, GIS servers, AI endpoints and stray configuration or backup files	T1595.002 Vulnerability Scanning; T1594 Search Victim-Owned Websites
Walk in	Default passwords on a GIS server; credentials lifted from a Yamaha or VPN configuration; a published edge-device flaw	T1078.001 Default Accounts; T1552.001 Credentials In Files; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Borrow trust	Use a vendor app's existing consent to sign in to customer tenants without a user, as Storm-0940 did	T1199 Trusted Relationship; T1195 Supply Chain Compromise; T1078.004 Cloud Accounts
Spray	Thousands of password attempts a minute from one address, across many tenants	T1110.003 Password Spraying
Phish in Japanese	Generate Japanese forms and fake login pages, or OAuth consent and device-code lures	T1566.002 Spearphishing Link; T1056.003 Web Portal Capture
Stay	Add credentials to apps, grant roles, drop web shells, run C2 beacons	T1098.001 Additional Cloud Credentials; T1098.003 Additional Cloud Roles; T1505.003 Web Shell; T1071.001 Web Protocols
Take	Read Key Vault secrets, mail and files; ship results over the C2 channel	T1555.006 Cloud Secrets Management Stores; T1530 Data from Cloud Storage; T1041 Exfiltration Over C2 Channel
Steal compute	Run someone else's AI endpoint or cloud model account for inference	T1496.004 Cloud Service Hijacking
Stay quiet	Throttle per target, rotate VPN and residential addresses, copy a genuine app's user agent	T1090.002 External Proxy; T1090.003 Multi-hop Proxy

How these platforms get around their own guard rails. ARTEX's default block on government and education domains, and CyberStrikeAI's block on .gov-style domains, are settings in software the attacker controls. CyberStrikeAI's default does not recognise Japanese government domains at all. A guard rail in the attacker's copy of the tool is not a control the defender can rely on.

Why throttling matters. A platform working on dozens of organisations at once can afford to be slow at each. Per-target rate limits and per-organisation alert thresholds then see nothing unusual; what stands out is breadth: many kinds of door tried by one source over many hours. The queries below look for that.

The defender's playbook

1. Close the doors the reports name

Management pages. Take edge-device, router, WebLogic and GIS administration pages off the internet, or put them behind a VPN with MFA. Case 3 lived on these.
Default and reused passwords. Change the defaults on every appliance and server, starting with GIS servers and anything installed by a contractor.
Configuration files hold keys. Assume any configuration file that has left a device holds live credentials. After an edge device or router is compromised, rotate every password, pre-shared key and API key in its configuration, not only the admin password.
AI endpoints are now targets. Require authentication on model servers, AI workflow tools and LLM gateways; cap spending; keep cloud model keys out of code. Case 2 and Symantec's agent both wanted free inference.
Vendor apps with tenant-wide rights. List the third-party apps that hold application permissions in Entra ID, remove what is unused, and ask each vendor how it protects the credentials behind its app.

2. Hunt for the patterns

Each query below is published in full and as a download. The KQL was parsed and analysed against the table schemas on Microsoft Learn; none has been run against a live workspace. Treat results as leads.

Vendor app signs in from a new network, then changes the directory (Microsoft Sentinel; the Storm-0940 pattern). Download

// Illustrative; not executed against a live workspace. Microsoft Sentinel / Log Analytics:
// AADServicePrincipalSignInLogs and AuditLogs. The Storm-0940 pattern Microsoft described on 21 October 2026:
// a third-party app signs in from a network it has not used in the previous 30 days, then the same service
// principal adds credentials, assigns roles or grants consent. Review candidates, not verdicts: vendors move
// hosting, so confirm with the vendor before you revoke anything, and preserve the logs first.
let Window = 7d;
let Baseline = 30d;
let PublishedAppIds = dynamic(["506e08f9-6e9a-4da4-942b-a099a03644ae", "24205314-2b89-4e07-a2a4-579e898a5640",
    "0de14c77-b9b0-4137-9360-34878a929827"]);  // ConnectWise app IDs in Microsoft's 21 October 2026 post
let MicrosoftOwnerTenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
let ChangeOperations = dynamic(["Add service principal credentials", "Add member to role", "Add eligible member to role",
    "Add scoped member to role", "Add app role assignment to service principal", "Add delegated permission grant",
    "Consent to application", "Add owner to application", "Add owner to service principal"]);
let VendorSignIns = AADServicePrincipalSignInLogs
    | where TimeGenerated > ago(Window + Baseline)
    | where ResultType == "0"
    | where (AppOwnerTenantId != AADTenantId and not(AppOwnerTenantId in (MicrosoftOwnerTenants)))
        or AppId in (PublishedAppIds)
    | extend Network = iff(isempty(AutonomousSystemNumber), IPAddress, strcat("AS", AutonomousSystemNumber));
let Known = VendorSignIns
    | where TimeGenerated <= ago(Window)
    | summarize KnownNetworks = make_set(Network, 500) by AppId;
let NewNetworkSignIns = VendorSignIns
    | where TimeGenerated > ago(Window)
    | join kind=leftouter Known on AppId
    | where isnull(KnownNetworks) or not(set_has_element(KnownNetworks, Network)) or AppId in (PublishedAppIds)
    | summarize FirstNewSignIn = min(TimeGenerated), LastNewSignIn = max(TimeGenerated), SignIns = count(),
        Networks = make_set(Network, 10), IPs = make_set(IPAddress, 20), UserAgents = make_set(UserAgent, 10),
        CredentialTypes = make_set(ClientCredentialType, 5), Resources = make_set(ResourceDisplayName, 10)
        by AppId, ServicePrincipalId, ServicePrincipalName;
let ChangesByApps = AuditLogs
    | where TimeGenerated > ago(Window)
    | where OperationName in~ (ChangeOperations) or OperationName contains "Certificates and secrets management"
    | extend ActorServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
    | where isnotempty(ActorServicePrincipalId)
    | summarize FirstChange = min(TimeGenerated), Changes = make_set(OperationName, 20),
        ChangedTargets = make_set(tostring(TargetResources[0].displayName), 20) by ActorServicePrincipalId;
NewNetworkSignIns
| join kind=leftouter ChangesByApps on $left.ServicePrincipalId == $right.ActorServicePrincipalId
| extend ChangedDirectoryAfterNewSignIn = isnotnull(FirstChange) and FirstChange >= FirstNewSignIn
| project-away ActorServicePrincipalId
| order by ChangedDirectoryAfterNewSignIn desc, FirstNewSignIn asc

Password spraying at machine pace (Microsoft Sentinel). Download

// Illustrative; not executed against a live workspace. Microsoft Sentinel / Log Analytics: SigninLogs and
// AADNonInteractiveUserSignInLogs. Password spraying at machine pace: one source failing against many accounts
// within a minute. Storm-0940's 10-14 October 2026 campaign peaked at 2,900 failures a minute, and nearly 98% of
// its responses were lockouts. Thresholds are starting points; tune them to your tenant before alerting.
let Window = 14d;
let FailuresPerMinute = 60;
let AccountsPerMinute = 10;
let FailureCodes = dynamic(["50126", "50053"]);  // invalid username or password; account locked or source blocked
let SignIns = union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(Window);
let Bursts = SignIns
    | where ResultType in (FailureCodes)
    | summarize Failures = count(), Accounts = dcount(UserPrincipalName), Lockouts = countif(ResultType == "50053"),
        UserAgents = make_set(UserAgent, 5), Apps = make_set(AppDisplayName, 5)
        by IPAddress, AutonomousSystemNumber, Minute = bin(TimeGenerated, 1m)
    | where Failures >= FailuresPerMinute or Accounts >= AccountsPerMinute;
let Sources = Bursts
    | summarize BurstMinutes = count(), PeakFailuresPerMinute = max(Failures), PeakAccountsPerMinute = max(Accounts),
        TotalFailures = sum(Failures), TotalLockouts = sum(Lockouts), FirstBurst = min(Minute), LastBurst = max(Minute),
        SampleUserAgents = take_any(UserAgents), SampleApps = take_any(Apps)
        by IPAddress, AutonomousSystemNumber
    | extend LockoutPercent = round(100.0 * TotalLockouts / TotalFailures, 1);
let Successes = SignIns
    | where ResultType == "0"
    | summarize FirstSuccess = min(TimeGenerated), SuccessfulAccounts = make_set(UserPrincipalName, 20) by IPAddress;
Sources
| join kind=leftouter Successes on IPAddress
| extend SucceededFromSameSource = isnotnull(FirstSuccess)
| project-away IPAddress1
| order by SucceededFromSameSource desc, PeakFailuresPerMinute desc

Stolen inference on AWS (Microsoft Sentinel with the AWS connector; cases like TrendAI's second and Symantec's agent). Download

// Illustrative; not executed against a live workspace. Microsoft Sentinel: AWSCloudTrail (Amazon Web Services
// connector). Inference theft: a key or role that lists or unlocks models, or deletes invocation logging, and
// invokes models from an address it has not used in the previous 30 days. TrendAI's second Japan case and
// Symantec's "Skynet mode" agent both went after cheap inference. Whether model invocations reach CloudTrail
// depends on how your trail is configured; check that before you read an empty result as a clean one.
let Window = 7d;
let Baseline = 30d;
let Recon = dynamic(["ListFoundationModels", "GetModelInvocationLoggingConfiguration"]);
let Unlock = dynamic(["PutUseCaseForModelAccess", "CreateFoundationModelAgreement", "PutFoundationModelEntitlement"]);
let Blind = dynamic(["DeleteModelInvocationLoggingConfiguration"]);
let Invoke = dynamic(["InvokeModel", "InvokeModelWithResponseStream", "Converse", "ConverseStream"]);
let Bedrock = AWSCloudTrail
    | where TimeGenerated > ago(Window + Baseline)
    | where EventSource == "bedrock.amazonaws.com"
    | extend Caller = coalesce(UserIdentityAccessKeyId, UserIdentityArn);
let Known = Bedrock
    | where TimeGenerated <= ago(Window)
    | where EventName in (Invoke)
    | summarize KnownIPs = make_set(SourceIpAddress, 500) by Caller;
Bedrock
| where TimeGenerated > ago(Window)
| summarize Invocations = countif(EventName in (Invoke)),
    InvocationIPs = make_set_if(SourceIpAddress, EventName in (Invoke), 50),
    ReconCalls = countif(EventName in (Recon)), UnlockCalls = countif(EventName in (Unlock)),
    LoggingDeletes = countif(EventName in (Blind)),
    BearerTokenCalls = countif(tostring(parse_json(AdditionalEventData).callWithBearerToken) =~ "true"),
    DeniedCalls = countif(isnotempty(ErrorCode)), Regions = make_set(AWSRegion, 10), UserAgents = make_set(UserAgent, 10),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Caller, UserIdentityArn, RecipientAccountId
| join kind=leftouter Known on Caller
| extend NewInvocationIPs = set_difference(InvocationIPs, coalesce(KnownIPs, dynamic([])))
| where array_length(NewInvocationIPs) > 0 or UnlockCalls > 0 or LoggingDeletes > 0
| extend ReconAndInvoke = ReconCalls > 0 and Invocations > 0
| project-away Caller1, KnownIPs
| order by LoggingDeletes desc, UnlockCalls desc, ReconAndInvoke desc, Invocations desc

Slow probing of many kinds of door (Azure Application Gateway logs, and the same logic for Splunk's Web data model). Download KQL · Download SPL

// Illustrative; not executed against a live workspace. Azure Monitor Logs: resource-specific AGWAccessLogs.
// Slow, wide probing of the doors used in TrendAI's three Japan cases: admin panels, WebLogic, edge-device login
// pages, GIS servers, AI endpoints, and configuration or backup files. A platform that throttles its traffic to
// each target stays under rate limits, so this looks for breadth over hours rather than volume. If a CDN or
// another proxy fronts the gateway, ClientIp is that proxy. Review candidates, not verdicts.
let Window = 7d;
let AuthorisedScanners = dynamic(["REPLACE_WITH_AUTHORISED_SCANNER_IP"]);
let Probes = AGWAccessLogs
    | where TimeGenerated > ago(Window)
    | where not(ClientIp in (AuthorisedScanners))
    | extend Path = tolower(tostring(split(RequestUri, "?")[0]))
    | extend Door = case(
        Path matches regex @"^/(arcgis/(admin|manager|rest/admin)|geoserver/(web|rest))", "GIS server",
        Path matches regex @"^/(v1/(models|chat/completions|completions|embeddings)|api/(tags|generate|ps)|rest/workflows|console/api)", "AI endpoint",
        Path matches regex @"^/(remote/login|\+cscoe\+/|vpn/index\.html|logon/logonpoint|tmui/|mgmt/tm/)", "Edge-device login",
        Path matches regex @"^/(console/login|wls-wsat|_async|bea_wls_internal)", "WebLogic",
        Path matches regex @"(^/\.env|/\.git/|/web\.config|/wp-config\.php|\.(bak|old|sql|tar|tgz|zip|7z)$|^/backup)", "Config or backup file",
        Path matches regex @"^/(admin|administrator|manager|phpmyadmin|actuator|server-status)(/|$)", "Admin panel",
        "")
    | where isnotempty(Door);
let Pace = Probes
    | summarize PerMinute = count() by ClientIp, Minute = bin(TimeGenerated, 1m)
    | summarize PeakPerMinute = max(PerMinute), ActiveMinutes = count() by ClientIp;
Probes
| summarize Requests = count(), Doors = make_set(Door), Paths = dcount(Path), SamplePaths = make_set(Path, 15),
    Statuses = make_set(HttpStatus, 10), Hosts = make_set(Host, 10), UserAgents = make_set(UserAgent, 5),
    ActiveHours = dcount(bin(TimeGenerated, 1h)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by ClientIp
| join kind=inner Pace on ClientIp
| extend DoorCount = array_length(Doors)
| where DoorCount >= 2 and Paths >= 5
| extend Throttled = PeakPerMinute <= 30 and ActiveHours >= 3, GotA200 = set_has_element(Statuses, 200)
| project-away ClientIp1
| order by Throttled desc, DoorCount desc, Paths desc

| tstats summariesonly=true count FROM datamodel=Web WHERE earliest=-7d BY Web.src Web.uri_path Web.status _time span=1m
| rename Web.* AS *
| search NOT src IN ("REPLACE_WITH_AUTHORISED_SCANNER_IP")
| eval path=lower(uri_path)
| eval door=case(match(path, "^/(arcgis/(admin|manager|rest/admin)|geoserver/(web|rest))"), "GIS server", match(path, "^/(v1/(models|chat/completions|completions|embeddings)|api/(tags|generate|ps)|rest/workflows|console/api)"), "AI endpoint", match(path, "^/(remote/login|\+cscoe\+/|vpn/index\.html|logon/logonpoint|tmui/|mgmt/tm/)"), "Edge-device login", match(path, "^/(console/login|wls-wsat|_async|bea_wls_internal)"), "WebLogic", match(path, "(^/\.env|/\.git/|/web\.config|/wp-config\.php|\.(bak|old|sql|tar|tgz|zip|7z)$|^/backup)"), "Config or backup file", match(path, "^/(admin|administrator|manager|phpmyadmin|actuator|server-status)(/|$)"), "Admin panel")
| where isnotnull(door)
| stats sum(count) AS per_minute values(door) AS doors values(path) AS path_list values(status) AS statuses BY src _time
| eval hour=floor(_time/3600)
| stats sum(per_minute) AS requests max(per_minute) AS peak_per_minute dc(hour) AS active_hours dc(doors) AS door_count values(doors) AS doors dc(path_list) AS paths values(statuses) AS statuses min(_time) AS first_seen max(_time) AS last_seen BY src
| where door_count >= 2 AND paths >= 5
| eval throttled=if(peak_per_minute <= 30 AND active_hours >= 3, "yes", "no"), got_a_200=if(isnotnull(mvfind(statuses, "^200$")), "yes", "no")
| convert ctime(first_seen) ctime(last_seen)
| sort 0 -door_count -paths

On endpoints and servers. Platforms with built-in WebShell and C2 leave the usual server-side traces: a web server process starting a shell, new scripts in the web root, and outbound connections from the web server. Our PHP2Shell detection pack has Sentinel and CrowdStrike rules for exactly those.
APIs and site functions. For the twelve-breach pattern, the enumeration and error-storm searches in our skyticket analysis and the tests in our API security guide still apply.

3. Use the published indicators with care

Download Microsoft's Storm-0940 indicators: three addresses, three VPN addresses relevant only on 15 and 16 October, the three ConnectWise app IDs and five user agents, each with its period and caveat. The app IDs belong to a legitimate vendor; finding one in your tenant means it is installed, not that it was abused. The table below keeps the indicators published for the South Korean ARTEX campaign. A match is a lead that needs dates and activity; no match is not proof of safety.

Indicator	Type	Source	Period	Context
`38.244.50[.]120`	IP address	CrowdStrike, 7 Oct 2026	Late Sep – early Oct 2026	Hosted the ARTEX instance and open directory in the Korean report; also in JPCERT/CC case E on 23 Oct, without an observation period
`101.53.80[.]20`, `205.214.59[.]31`, `124.155.252[.]63`, `154.201.79[.]246`, `23.248.249[.]90`, `23.158.220[.]98`, `103.248.148[.]84`, `203.160.133[.]172`, `209.209.85[.]38`	IP addresses	CrowdStrike, 7 Oct 2026	Late Sep – early Oct 2026	Proxies used by the actor
`xcai[.]pro`	Domain	CrowdStrike, 7 Oct 2026	Late Sep – early Oct 2026	Likely reseller of language-model API access
`38.11.173.x` (reported as two adjacent /24 blocks)	IP range	Team Cymru, 2 Oct 2026	Early Oct 2026	Hosts running ARTEX; not confirmed as attack infrastructure

For ARTEX's traffic, the Korean firm Theori has published free Suricata and Sigma rules; review them against your own traffic before blocking on them. Digital Today

4. If a vendor app was abused

Preserve first. Export Entra sign-in and audit logs, Purview audit records and Graph activity before you change anything; Microsoft advises reviewing from 1 October.
Contain without deleting. Disable the app's service principal rather than deleting it, and record its object ID in each tenant; search by app ID, not display name.
Look for what the agent added. New credentials on any app, new owners, app-role assignments, consent grants, role assignments (especially Global Administrator), and Conditional Access changes.
Rotate what it could read. Key Vault secrets and any keys the app could reach; then check that the vendor's own rotation removed its access.
Report. In Japan, report to JPCERT/CC and, where personal data may be affected, assess the duty to report to the Personal Information Protection Commission.

5. Which teams should act

Team	Exposure to review	Next step	Evidence needed
IT Operations	Edge devices, routers, WebLogic, GIS servers, AI endpoints	Remove internet access to management pages; change default passwords; rotate secrets kept in configurations	Asset list, change records, dates
SIEM / SOC	Entra sign-ins and audit logs since 1 October; web and gateway logs since August	Schedule the four searches above; check the Microsoft, CrowdStrike and JPCERT/CC indicators with dates	Query schedule, findings
EDR	Web servers and anything behind the reachable doors	Hunt for web-server shells, new web-root scripts and beacons	Process trees, file timelines
Third-party Risk	Vendors whose apps hold tenant-wide permissions	Ask how each protects its app credentials and how it would tell you of a compromise	Written answers
Legal / Privacy	Notices that may need updating	If an investigation finds an AI platform was used, decide whether to say so; it helps others defend	Decision record

What remains unknown

Which organisations were on TrendAI's lists, and whether any of them has disclosed a breach.
Which AI models powered the three TrendAI cases, and whether the 44 agents were the operator's own configuration.
Whether Storm-0940 reached any Japanese tenant; Microsoft's report names none.
Which tool, if any, was involved in each of the twelve Japanese breaches.
How many breaches have not been disclosed. Our tracker only sees notices.

Sources and updates

The new reports

TrendAI, 27 October 2026, as summarised by The Hacker News and DEV Community; and TrendAI's 12 October advisory on Japan
Microsoft: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026
Seoul Metropolitan Police announcement, 26 October 2026, as reported by Hankook Ilbo, SBS and News1 (Korean)
CyberStrikeAI repository and its default domain rule at commit 5affb4d
Team Cymru: tracking CyberStrikeAI usage · Amazon: AI-augmented threat actor accesses FortiGate devices at scale
Microsoft Digital Defense Report 2026, as reported by Help Net Security
Other campaigns: linked in the table above.

ARTEX and the Korean bank campaign

Japan

JPCERT/CC: JPCERT-AT-2026-0030, unauthorised access to domestic organisations (Japanese), 8 October 2026, updated 23 October
Macnica: the wave of data leaks from web systems (Japanese), 7 October 2026, updated 8 October
NICT: A2B attack alert (Japanese), 13 October 2026
Company notices: linked in the table above. We read the notices of IDARE, Sammy Networks, Studio, Fancl and Attenir, Commune, Resort Trust, dip and Coconala directly; for Lawson, skyticket, infoQ and SourceNext we rely on the checks made for our earlier articles.

Method. The 87 notices come from our breach tracker, which records each company's own dates and routes. “Direct attacks” excludes the customers of a breached supplier, who are counted once at the supplier. The CyberStrikeAI findings come from our own reading of the public repository at commit 5affb4d on 28 October 2026: we counted agent definitions and tool recipes across the tagged versions and ran the default domain rule's pattern against sample hostnames in a separate test program; no code from the repository was executed. Every indicator in the Storm-0940 download was checked against Microsoft's page.

20 October 2026: first published as “Was it ARTEX?”. Sources checked on 19 October 2026 (JST). We could not open the ARTEX repository; its dates and features come from piyolog's review and from CrowdStrike.

24 October 2026: added JPCERT/CC's 23 October findings, corrected the earlier zero-overlap conclusion, and added the indicator download and detection limitations. Network restrictions prevented reopening JPCERT/CC's research blog and CrowdStrike's report.

28 October 2026: retitled and restructured around TrendAI's three attacker environments, Microsoft's Storm-0940 report and the Seoul arrests. Added our reading of the CyberStrikeAI code, the AI-role figure, the landscape table, an updated attacker's playbook, four searches, a Storm-0940 indicator download and a new cover. The twelve-company table is unchanged and was not re-audited. Our build environment could not open TrendAI's report, JPCERT/CC, Team Cymru, Amazon, Unit 42, GreyNoise or the Korean outlets; for those we relied on search-engine extracts of the pages, and TrendAI's case details come from two independent summaries. Microsoft's report and the CyberStrikeAI repository were read directly. No query was run in a live tenant, and no address was contacted.

30-second briefing