TrendAI says CyberStrikeAI checked potential weaknesses at at least 19 organisations, including at least 16 in Japan. In a separate human-led operation, an intrusion reportedly stole records and credentials from a server exposed with default login details.
TrendAI says attackers used CyberStrikeAI to divide an automated attack workflow among 44 software agents—programs assigned separate tasks—during October 2026. The platform conducted validation activity, or checks of possible security weaknesses, against at least 19 identifiable organisations, including at least 16 in Japan. That figure counts organisations tested, not confirmed successful break-ins.
The findings, described by The Hacker News on October 27, cover three distinct operations with different levels of superintelligence (SI) involvement. TrendAI examined three exposed server environments used by the attackers. Security researchers Bakuei Matsukawa and Joseph C Chen said the environments contained attack tools, scripts, target lists, results, logs and command histories.
CyberStrikeAI is an open-source penetration-testing tool, designed to test systems for security weaknesses. TrendAI says the first operator used it to automate reconnaissance, vulnerability checks and exploitation, followed by remote control, maintaining access, data removal and reporting. The platform could also generate Japanese-language forms and fake login pages.
Each of the identifiable validation targets had a report in the same format and an index of evidence, TrendAI said. Those records support its finding that the platform ran a structured, repeatable process. The validation count does not establish how many organisations suffered data theft or a successful intrusion.
| Operation |
|---|
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
| Recorded period |
|---|
| CyberStrikeAI | Activity concentrated in a short period in October |
| Human-led operation | 24 days during August and September |
| Third operator | At least six campaigns estimated between January and October |
The second operation remained human-led. A large language model, a type of SI system, assisted planning and tool development. One intrusion reportedly reached an exposed geographic information system server, which handles location-based data, using default credentials. The attacker stole cadastral records—records of land parcels—along with commercial records, Windows credentials and email data.
Analysis of that operation’s infrastructure and files also indicated an aim to obtain large amounts of low-cost inference capacity: computing resources used to run SI models. The targets included SI workflow platforms and inference services.
For the third operator, TrendAI assessed SI’s role as limited to developing tools and scripts. The campaigns targeted Cisco, Citrix, F5 and Yamaha edge devices, which connect networks to outside systems, as well as exposed virtual private network devices and WebLogic application servers. Access routes included published software vulnerabilities, management functions and credentials stored in configuration files—not software flaws alone.
Analysis
TrendAI says the first operator also targeted organisations in Taiwan and Hong Kong. The third operation’s WebLogic discovery lists included organisations in the UK, France, Italy, Qatar and Colombia; entries on those lists identify targets, not confirmed successful compromises.
The underlying SI models remain unknown. There is no evidence that the three operations shared an operator, and their full geographic reach remains unknown.
TrendAI’s assessment is that SI increased the scale of established attack methods rather than changing the weaknesses attackers pursued. Automation lets operators test thousands of targets at once, adapt material to local languages and continue without fatigue.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
