{"id":"CMP-202610-chinese-speaking-crews-use-ai-agents-cyberstrikeai-44-agents","kind":"campaign","aliases":[],"related":[],"title":"Chinese-speaking crews use AI agents (CyberStrikeAI, 44 agents) to break into exposed legacy web systems, VPNs and WebLogic in Japan","description":null,"summary":"Trend Micro reconstructed three attack infrastructures from attacker open directories, all run by Simplified-Chinese-speaking operators focused on Japan (published in Japanese 2026-10-23, in English 2026-10-27). The activity is separate from the ARTEX attacks. Case A (October 2026): the open-source CyberStrikeAI framework ran 44 AI agents that automated recon, exploitation, C2, persistence and exfiltration against at least 19 organisations (16 in Japan, also Taiwan and Hong Kong). The targets were legacy web systems at smaller businesses and local public bodies, and traffic per target was throttled to avoid notice. The deepest intrusion started at an unauthenticated, internet-exposed admin interface. Case B (Aug-Sep 2026): a human-led crew used an LLM for planning and tools. It scanned 6,000+ Japanese IPs, fully compromised legacy web systems (FTP, DB, web shell, SSH, backdoors restored after cleanup), stole data from a GIS server with default credentials, and tried to hijack exposed AI/GPU inference services. Case C (Jan-Oct 2026): a crew targeted exposed VPN and edge devices (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP) and 1,300+ Oracle WebLogic servers. It logged into Yamaha RTX1210 routers using credentials left in obtained config files. No new vulnerability was involved. Organisations with internet-exposed legacy admin panels, default or leftover credentials, or edge devices, especially in Japan, South Korea and Taiwan, are at risk. Victim names and IOCs were not published.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T19:09:21+00:00","products":[{"name":"Yamaha RTX1210","fixed":[],"affected":"devices with leaked/leftover credentials","ecosystem":"vendor"},{"name":"Oracle WebLogic Server","fixed":[],"affected":"internet-exposed","ecosystem":"vendor"},{"name":"Cisco SD-WAN","fixed":[],"affected":"internet-exposed","ecosystem":"vendor"},{"name":"Citrix NetScaler","fixed":[],"affected":"internet-exposed","ecosystem":"vendor"},{"name":"F5 BIG-IP","fixed":[],"affected":"internet-exposed","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Inventory internet-exposed admin interfaces on legacy web systems and check whether any of them need no login.\n- Check for default credentials on GIS servers and other exposed apps, and on internally run AI inference, workflow or GPU services.\n- On Yamaha RTX1210 and other VPN routers: look for VPN logins from unknown sources, and check whether credentials have ever been stored in exported or backed-up config files.\n- Check that exposed Oracle WebLogic, Cisco SD-WAN, Citrix NetScaler and F5 BIG-IP are on current patches, and review their management-interface exposure.\n- Look for low-and-slow scanning spread over long periods, and for web shells or backdoors that reappear after cleanup.\n- Specific IOCs: unknown (Trend Micro did not publish them in the overview).","fix":"- Take legacy admin interfaces off the internet or put authentication in front of them. Remove default credentials.\n- Rotate VPN and router credentials, especially on Yamaha RTX1210, that may have appeared in config files or backups.\n- Patch exposed edge devices and WebLogic, and restrict access to their management interfaces.\n- Add AI, inference and GPU services to the asset inventory and require authentication on them.\n- After cleaning a web compromise, hunt for re-planted backdoors and rotate all credentials on the host.","status":"open","published_at":"2026-10-23T00:00:00+00:00","first_seen_at":"2026-10-27T19:09:21+00:00","triaged_at":"2026-10-27T19:09:21+00:00","updated_at":"2026-10-27T19:09:21+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':80B,85B '-202610':24A '-23':81B '-27':86B '000':185B '1':244B '16':122B '19':120B '2026':79B,84B,98B,169B,224B '300':245B '44':9A,33A,106B '6':184B 'activ':88B 'admin':162B,273B 'agent':7A,10A,108B 'agents':31A,34A 'ai':6A,30A,107B 'ai/gpu':216B 'also':125B 'artex':93B 'attack':59B,62B,94B 'aug':167B 'aug-sep':166B 'autom':110B 'avoid':150B 'b':165B 'backdoor':198B 'big':49A,241B 'big-ip':48A,240B 'bodi':142B 'break':12A 'busi':138B 'c':220B 'c2':113B 'campaign':51B 'case':95B,164B,219B 'chines':2A,70B 'chinese':26A 'chinese-speak':1A 'chinese-speaking-crews-use-ai-agents-cyberstrikeai':25A 'cisco':41A,233B 'citrix':45A,237B 'cleanup':201B 'cmp':23A 'compromis':189B 'config':260B 'credenti':210B,256B,278B 'crew':4A,174B,226B 'crews':28A 'cyberstrikeai':8A,32A,35A,103B 'data':203B 'db':194B 'deepest':153B 'default':209B,275B 'devic':232B,281B 'directori':64B 'earli':53B 'early-warn':52B 'edg':231B,280B 'english':83B 'especi':282B 'exfiltr':116B 'exploit':112B 'expos':14A,161B,215B,228B,271B 'f5':47A,239B 'file':261B 'focus':73B 'framework':104B 'ftp':193B 'fulli':188B 'gis':206B 'hijack':214B 'hong':128B 'human':172B 'human-l':171B 'infer':217B 'infrastructur':60B 'interfac':163B 'internet':160B,270B 'internet-expos':159B,269B 'intrus':154B 'involv':266B 'ioc':295B 'ip':50A,187B,242B 'jan':222B 'jan-oct':221B 'japan':22A,75B,124B,284B 'japanes':78B,186B 'kong':129B 'korea':286B 'least':119B 'led':173B 'left':257B 'leftov':277B 'legaci':15A,133B,190B,272B 'llm':177B 'local':140B 'log':250B 'micro':56B 'name':293B 'netscal':238B 'netscaler':46A 'new':263B 'notic':151B 'obtain':259B 'oct':223B 'octob':97B 'open':63B,101B 'open-sourc':100B 'oper':72B 'oracl':246B 'oracle':38A 'organis':121B,267B 'panel':274B 'per':145B 'persist':114B 'plan':179B 'public':141B 'publish':76B,298B 'ran':105B 'recon':111B 'reconstruct':57B 'restor':199B 'risk':291B 'router':254B 'rtx1210':37A,253B 'run':66B 'scan':183B 'sd':43A,235B 'sd-wan':42A,234B 'sep':168B 'separ':90B 'server':40A,207B,248B 'servic':218B 'shell':196B 'simplifi':69B 'simplified-chinese-speak':68B 'smaller':137B 'sourc':102B 'south':285B 'speak':3A,71B 'speaking':27A 'ssh':197B 'start':155B 'stole':202B 'system':17A,135B,192B 'taiwan':126B,288B 'target':131B,146B,227B 'three':58B 'throttl':148B 'tool':181B 'traffic':144B 'trend':55B 'tri':212B 'unauthent':158B 'use':5A,29A,175B,255B 'victim':292B 'vpn':229B 'vpns':18A 'vulner':264B 'wan':44A,236B 'warn':54B 'web':16A,134B,191B,195B 'weblog':20A,247B 'weblogic':39A 'yamaha':36A,252B","nicknames":["CyberStrikeAI"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-chinese-speaking-crews-use-ai-agents-cyberstrikeai-44-agents","url":null,"severity":null,"published_at":"2026-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-27T19:09:21+00:00","fetched_at":"2026-10-27T19:09:21+00:00","note":null}],"documents":[{"id":7301,"url":"https://x.com/TheHackersNews/status/2115148396969488395","title":"@TheHackersNews: 🚨 44 AI agents coordinating cyberattacks.\n\nCyberStrikeAI is being used to automa","kind":"post","source":"x","text":"🚨 44 AI agents coordinating cyberattacks.\n\nCyberStrikeAI is being used to automate attacks targeting Japanese organizations, from reconnaissance and exploitation to command-and-control.\n\nAt least 19 organizations were subjected to vulnerability validation.\n\nRead: https://t.co/86KZwQsx6P\n\nlikes 141 reposts 37","published_at":"2026-10-27T18:27:30+00:00","relation":"describes","confidence":null,"note":null},{"id":7484,"url":"https://www.trendaisecurity.com/en/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan","title":"Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan (Trend Micro / TrendAI)","kind":"blog","source":"analyst","text":"Trend Micro (Bakuei Matsukawa, Joseph C Chen), English edition of Oct 23 Japanese article. Three Simplified-Chinese-speaking attack infrastructures found in open directories, focused on Japan, separate from ARTEX. Case A (Oct 2026): CyberStrikeAI open-source AI agent pentest framework with 44 agents automating recon, exploitation, C2, persistence, exfiltration; at least 19 orgs (16 in Japan, also Taiwan, Hong Kong), legacy web systems of small businesses and local public sector; deepest intrusion via unauthenticated public admin interface; throttled traffic per target. Case B (Aug-Sep 2026): human-led with LLM planning; 6,000+ Japanese IPs scanned; legacy web systems and exposed AI/GPU inference infrastructure; GIS server with default credentials; backdoors restored after cleanup. Case C (Jan-Oct 2026): exposed VPN devices (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210 via credentials left in config files) and 1,300+ Oracle WebLogic candidates. No novel vulnerability. No IOCs published in overview.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}