Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques

This campaign involved AI-assisted cyber attacks beginning in October 2026, targeting organizations primarily in Japan. The attackers leveraged AI to automate vulnerability scanning and API exploitation, including SSRF vulnerabilities. They conducted APK analysis and reverse engineering of Flutter applications to identify exploitable APIs. Multiple attack servers hosted tools for analyzing Android apps and targeting infrastructure components like web applications, MySQL, Jenkins, and email gateways. The threat actors employed evasion techniques against endpoint detection and response (EDR) systems and deployed web shells to maintain internal network presence. The attacks extended beyond Japan, showing a broader operational scope. Indicators include IP addresses linked to the attack infrastructure. No specific CVEs or affected software versions were identified.

The campaign resulted in unauthorized access and leakage of personal information from multiple organizations. The use of AI to automate vulnerability discovery and exploitation increased the efficiency and scale of attacks. The deployment of web shells and evasion of EDR systems facilitated persistent internal access, potentially enabling further compromise of targeted networks and services. The attacks targeted a range of infrastructure components, increasing the risk of disruption or data exfiltration. The broader targeting beyond Japan suggests a wider impact on global web services.

No official patches or fixes are specified for this campaign. Organizations should review the vendor advisory at https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html for detailed guidance. Mitigation should focus on securing APIs against known vulnerabilities such as SSRF, hardening endpoint detection and response systems to detect evasion attempts, and monitoring for web shell deployments. Conduct thorough analysis of Android and Flutter applications for exposed APIs and vulnerabilities. Implement network segmentation and restrict access to critical infrastructure components like MySQL, Jenkins, and email gateways. Regularly update and patch all software components to reduce exposure to known vulnerabilities.