AI-Enabled Cyberattack Campaigns Against Japan: Three Cases Beyond ARTEX (CyberStrikeAI, LLM-Assisted Intrusions, AI-Written Tooling)

Key facts for CyberStrikeAI Japan campaigns

Detection coverage for CyberStrikeAI Japan campaigns

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4916 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-4916 Oracle WebLogic Exploit-Path Probing and Encoded Traversal — Exploitation

Detects HTTP requests to Oracle WebLogic paths commonly abused for unauthenticated exploitation (wls-wsat, _async, bea_wls_internal, uddiexplorer, weblogicmanagement) and double-encoded traversal toward the WebLogic console. Case C of the Japan AI-enabled campaigns targeted 1,300+ Oracle WebLogic candidates (T1190, T1595.002) using known weaknesses rather than zero-days; no specific CVE is cited, so the rule keys on behaviour and path rather than a single CVE.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002
• Data sources: index=web sourcetype=access_combined, CommonSecurityLog, webserver logs
• Severity: high
• Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-24h (uri_path="/wls-wsat/*" OR uri_path="/_async/*" OR uri_path="/bea_wls_internal/*" OR uri_path="/uddiexplorer/*" OR uri_path="/management/weblogicmanagement/*" OR (uri_path="/console/*" AND (uri="*%252e%252e*" OR uri="*%2e%2e*")))
| eval encoded_traversal=if(match(uri,"(?i)(%252e%252e|%2e%2e)"),1,0)
| stats count AS requests, dc(uri_path) AS distinct_paths, sum(encoded_traversal) AS traversal_hits, count(eval(status=200 OR status=202)) AS ok_responses, values(status) AS statuses, min(_time) AS first_seen, max(_time) AS last_seen by clientip, host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - requests

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL has_any ("/wls-wsat/", "/_async/", "/bea_wls_internal/", "/uddiexplorer/", "/management/weblogicmanagement/") or (RequestURL has "/console/" and RequestURL has_any ("%252e%252e", "%2e%2e"))
| summarize Requests=count(), DistinctUrls=dcount(RequestURL), Urls=make_set(RequestURL, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DeviceVendor
| project SourceIP, DestinationIP, DeviceVendor, Requests, DistinctUrls, Urls, FirstSeen, LastSeen
| order by Requests desc

Sigma

title: Oracle WebLogic Exploit-Path Probing and Encoded Traversal (TL-2026-4916)
id: 6f3b1c1e-52a4-4d1b-9a77-3c2e8a4b9d01
status: experimental
description: Detects web requests to Oracle WebLogic paths commonly abused for unauthenticated exploitation, and double-encoded traversal toward the WebLogic console, consistent with the Case C campaign against 1,300+ WebLogic candidates.
references:
  - https://thecyberexpress.com/ai-cyberattacks-on-japan-artex-three-cases/
  - https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wls-wsat/'
      - '/_async/'
      - '/bea_wls_internal/'
      - '/uddiexplorer/'
      - '/management/weblogicmanagement/'
  selection_console:
    cs-uri-stem|contains: '/console/'
  selection_encoded:
    cs-uri-stem|contains:
      - '%252e%252e'
      - '%2e%2e'
  condition: selection_path or (selection_console and selection_encoded)
falsepositives:
  - Authorised vulnerability scanners or penetration tests against WebLogic
  - Legitimate WebLogic web-service clients that use the _async or wls-wsat endpoints internally
level: high

Known false positives:

• Authorised vulnerability scans or penetration tests against WebLogic servers
• Internal WebLogic web-service clients that legitimately call _async or wls-wsat endpoints

Tuning notes: Exclude known scanner and management source ranges via a lookup, and restrict to internet-facing WebLogic hosts. Treat ok_responses>0 or traversal_hits>0 as higher priority. Adjust index/sourcetype to the web, proxy or WAF source that fronts WebLogic.

• 🔒 TL-2026-4916 Distributed Low-Frequency VPN and Edge Device Authentication Failures — Exploitation · unlock with TL Creds
• 🔒 TL-2026-4916 Web Server or WebLogic Process Spawning Command Shell — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-4916 Wide IP-Block Sweep and CyberStrikeAI Host Traffic — C2 and Reconnaissance · unlock with TL Creds
• 🔒 TL-2026-4916 Citrix NetScaler and F5 BIG-IP Management Path Abuse — Exploitation · unlock with TL Creds
• 🔒 TL-2026-4916 Credential Harvesting From Configuration Files — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-4916 CyberStrikeAI Execution and AI-Generated Operator Script Artifacts — C2 and Tooling · unlock with TL Creds
• 🔒 TL-2026-4916 Web Shell Written to Web Application Directory and Re-Created After Cleanup — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-4916 SSH Logon With Default Account After Failed Attempts — Lateral Movement · unlock with TL Creds

Indicators of compromise for CyberStrikeAI Japan campaigns

As of 2026-10-31, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-4916.

Sample indicators (1 of 10)

• IP address: 212.11.64[.]250

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

How CyberStrikeAI Japan campaigns works

No AI-discovered zero-day was used; attacker identities and AI models are unconfirmed.

The Cyber Express (2026-10-29), summarizing Trend Micro/TrendAI research on attacker-side files from three separate attack infrastructures, documents Japan-focused activity that largely predates the ARTEX reporting. All three operations worked in Simplified Chinese, selected targets opportunistically, and relied on known weaknesses, legacy systems and poor configuration rather than AI-discovered zero-days. Researchers could not confirm a shared operator, and had no victim-side logs, so the success of individual attempts cannot be verified.

Case A (October 2026) used CyberStrikeAI, an open-source agent-based penetration-testing platform with a Simplified Chinese console, configured with 44 agents that split reconnaissance, exploitation, command and control, persistence, exfiltration and reporting. At least 19 organizations received identical automated reports, at least 16 of them in Japan, with further targets in Taiwan and Hong Kong, mostly smaller businesses and local public bodies. The framework generated Japanese-language forms and fake login pages and throttled traffic per target, so activity was hard to spot in any single victim's logs. Many log entries read 'no session, no web shell, no exfiltration'; the deepest intrusion was an unauthenticated administration interface on a legacy system. Results were organized in folders named jp_success, jp_attack and jp_cve_attack.

Case B (about 24 days across August-September 2026) was human-led with an LLM supporting planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. The operator framed requests as an authorized assessment to bypass the model's guardrails when targeting AI and GPU services, with the aim of hijacking and pooling other people's AI services for cheap inference capacity. At one victim the operator gained full control (FTP, database access, administrator rights, web shell, SSH) and repeatedly restored backdoors after cleanup; a GIS server with default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials and email. Several hundred attempts against one cluster failed.

Case C (January-October 2026, multiple parallel campaigns, six per secondary reporting) played down AI: it targeted at least 1,300 Oracle WebLogic candidates and 35 VPN entry points, mostly in Japan and South Korea, with additional lists covering the UK, France, Italy, Qatar and Colombia. Products named were Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP and Yamaha RTX1210; on the Yamaha routers no product vulnerability was exploited, instead leftover credentials in configuration files gave direct access to corporate networks. AI authorship of the operator's tooling is assessed with high confidence from echo '=== ... ===' section headings in command history and emoji status markers in scripts.

Observed AI limitations: the AI logged planned steps as finished and overstated success, and LLMs invented vulnerability IDs. Related public reporting (BleepingComputer, citing Team Cymru) places CyberStrikeAI (GitHub developer alias Ed1s0nZ, Go-based, 100+ integrated tools, supports GPT/Claude/DeepSeek models) on attacker infrastructure between 2026-01-20 and 2026-02-26 in a separate FortiGate-focused campaign; that is a different campaign and is not shown to be the same operator.

MITRE ATT&CK / ATLAS techniques by tactic:

Defense Evasion

AML.T0054 LLM Jailbreak

Lateral Movement

T1021.004 Remote Services: SSH

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595 Active Scanning; T1595.001 Active Scanning: Scanning IP Blocks; T1595.002 Active Scanning: Vulnerability Scanning

Remediation for CyberStrikeAI Japan campaigns

Patches

• Apply current vendor patches for WebLogic, Cisco, Citrix and F5 edge products; no specific CVE is cited in the source

Immediate actions

• Inventory and reduce internet-exposed systems, especially VPN gateways, WebLogic servers, GIS servers and legacy web admin interfaces
• Remove default and leftover credentials, including credentials stored in router/VPN configuration files (e.g. Yamaha RTX1210)
• Restrict or require authentication on public administration interfaces
• Hunt for distributed, low-frequency scanning and authentication attempts across many source IPs

Workarounds

• Place management interfaces behind VPN/allowlists
• Disable unused FTP and remote-management services

Longer-term hardening

• Update or isolate legacy infrastructure that cannot be patched
• Harden VPN configurations (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha) and rotate credentials after any exposure
• Monitor for web shells and backdoor re-creation after incident cleanup
• Prepare policies and abuse monitoring for LLM misuse through false-premise 'authorized assessment' requests and for hijacking of AI/GPU inference services

Affected and fixed versions

• Oracle — WebLogic Server
  Vulnerable versions: Internet-exposed instances (1,300+ candidates targeted)
• Cisco — SD-WAN
  Vulnerable versions: Exposed or weakly configured instances
• Citrix — NetScaler
  Vulnerable versions: Exposed or weakly configured instances
• F5 — BIG-IP
  Vulnerable versions: Exposed or weakly configured instances
• Yamaha — RTX1210
  Vulnerable versions: Configurations containing leftover credentials
• Various — GIS servers and legacy web systems with public administration interfaces
  Vulnerable versions: Default credentials or unauthenticated admin interface

Timeline of CyberStrikeAI Japan campaigns

• 2026-01-01 Case C operator begins parallel campaigns (January-October 2026) against 1,300+ WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea.
• 2026-01-20 locked-ioc-5 first observed on attacker infrastructure in a separate FortiGate-focused campaign (observed through 2026-02-26, per BleepingComputer/Team Cymru).
• 2026-08-01 Case B human-led, LLM-assisted intrusion begins (about 24 days across August-September), scanning 6,000+ Japanese IPs and probing AI assets in South Korea.
• 2026-09-30 Case B activity ends; full control at one victim and a GIS server with default credentials exposing several hundred thousand records.
• 2026-10-01 Case A: short October burst of locked-ioc-5 with 44 agents against at least 19 organizations (16+ in Japan, plus Taiwan and Hong Kong).
• 2026-10-20 GMO Cybersecurity publicly links the locked-ioc-10 AI tool to attacks on Japanese companies; most activity in the three cases predates this reporting.
• 2026-10-29 Trend Micro/TrendAI research on the three cases is reported by The Cyber Express and others.

Sources cited for CyberStrikeAI Japan campaigns

• CSA research note: CyberStrikeAI / ARTEX multi-agent offense labs.cloudsecurityalliance.org · Research · 2026-10-28
• AI's Role In Cyberattacks On Japan: Three Cases Beyond ARTEX thecyberexpress.com · News · 2026-10-29
• CyberStrikeAI Uses 44 AI Agents to Target Japanese Organizations esecurityplanet.com · News · 2026-10-29
• CyberStrikeAI Uses 44 AI Agents (The Hacker News) The Hacker News · News · 2026-10-29
• Three Japan-Focused Cyberattacks Show How Hackers Use AI (Security Affairs) securityaffairs.com · News · 2026-10-29
• CyberStrikeAI tool adopted by hackers for AI-powered attacks (BleepingComputer) BleepingComputer · News
• ARTEX AI Tool Linked to Cyberattacks on Japanese Companies (eSecurityPlanet) esecurityplanet.com · News · 2026-10-20
• Chinese AI Tool Likely Used in Cyberattacks on Japan Firms (Nippon.com) nippon.com · News · 2026-10-20

More in threat intel

• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
• Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)
• Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Q1 2026