Trend Micro dissects three Japan-focused attacks with varying AI roles

Trend Micro analyzed three 2026 attack infrastructures that used AI to different degrees, from AI agents running the whole workflow via CyberStrikeAI to LLM-assisted tool development. Japan was the main target, with entry through legacy systems and default credentials.

• Case A used AI agents for recon, exploitation and data theft across 19 targets
• Case B was human-led, with an LLM helping plan and build tools
• Case C saw limited AI use across at least six campaigns against VPNs and Oracle WebLogic
• Simplified Chinese was the working language in all three infrastructures