CyberStrikeAI framework coordinated agent-led intrusion attempts in Japan

TrendAI identified CyberStrikeAI agent traces and tooling used to attempt multi-step reconnaissance and intrusion tasks against organizations, most of them in Japan.

The campaign description comes from collected attacker-side artifacts; target lists and attempted operations are not equivalent to successful system access. The agents appeared to automate target enumeration and attempted credential or persistence stages across at least 19 organizations.

The report does not demonstrate successful shells on most targets or prove Chinese state attribution, and it describes other separate operators in the same research. Correlate each claimed successful stage against target logs and attacker tool output before elevating it from attempt to compromise.

Evidence interpretation and control boundary. TrendAI separates three threat streams rather than treating every observed scan as one actor or one autonomous campaign. The CyberStrikeAI traces indicate model-driven task execution, but many tool attempts lacked effective sessions or achieved no confirmed shell. Human-guided attacks against geospatial systems have different attribution and autonomy evidence. Retain observed access and extracted files only where the investigation documents actual effects.