Japan's JPCERT/CC finds about 1,000 servers used as bases for AI-driven cyberattacks

Around 1,000 servers suspected of serving as bases for AI-driven cyberattacks have been online since October, according to an investigation led by JPCERT/CC, Japan's computer emergency response coordination centre, Kyodo reports via The Mainichi. The probe, run with overseas cybersecurity firms since early October, found that the servers may have used AI to search for vulnerabilities and target websites worldwide. JPCERT/CC is tracking 600 to 700 of them.

Most of the servers hosted AI-powered platforms such as the penetration testing tool ARTEX, which Check Point Research linked to autonomous cybercrime campaigns earlier this month. They appeared to be searching for system vulnerabilities and trying to steal configuration files. One server contained traces of an AI programming support tool from Anthropic, suggesting that attackers used AI to strengthen their hacking, according to the report.

Some publicly accessible servers also held tools for analysing the internal structure of smartphone apps and programs for testing system vulnerabilities, used to attempt unauthorised access through interfaces that exchange data with external systems. "More sophisticated attacks will increase in the future," said Ken Sajo, an analyst at JPCERT/CC, as AI is still in the early stages of being used for cyberattacks.