A wave of data leaks from Japanese web systems in autumn 2026 has sharpened concern over AI's role in cyberattacks on Japan. The National Cybersecurity Office alerted businesses on October 9, and the chair of the ruling party's cybersecurity headquarters said cyberspace was in a "state of emergency."  Researchers reconstructed three attack infrastructures from files left in attackers' open directories. All three are separate from those in earlier reports on ARTEX, an autonomous AI penetration-testing system.   AI's role varied widely. Without victim-side logs, the findings cannot confirm each attempt's success, the full damage, or the attackers' identities. Victims are described only by count, industry, size, and country. 

Case A: Automated Cyberattacks on Japan 

In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like "credential-search agent 8/44" show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages.   It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read "no session, no web shell, no exfiltration." The deepest intrusion began at an unauthenticated administration interface on a legacy system. 

Case B: Human-Led, AI-Assisted 

Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model's guardrails. Other tools sought to hijack and pool access to other people's AI services, likely to get cheap inference capacity.  One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed. 

Case C: Limited AI Role 

From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia. Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks. Section headings such as echo '=== ... ===' in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded. 

Lessons Beyond ARTEX 

All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin.  AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs. These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases. 

Defending Against Cyberattacks on Japan 

Recommended steps: 

• Inventory public-facing systems and update or isolate legacy ones. 
• Remove exposed default credentials and admin interfaces. 
• Secure VPN and edge-device configurations against credential reuse. 
• Check internal AI and GPU services for exposure. 
• Monitor for low-frequency, distributed attempts. 
• Prepare for LLM misuse through requests built on false premises. 

Fast patching and virtual patching matter more as the time between disclosure and exploitation shrinks. The attackers' identities, the AI models used, and the full damage remain unknown. 

The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May.  

It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud. 

INJ3CTOR3 has targeted Asterisk-based phone systems since at least 2020. That November, Check Point Research named the group for exploiting CVE-2019-19006 in FreePBX. Unit 42 linked it to attacks on Elastix in 2022, and Fortinet documented its EncystPHP webshell in January 2026. 

How JOMANGY Now Exfiltrates FreePBX Secrets 

The September version of the k.php script ends with two new base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel, and Elastix systems to /hima_data/index.php. 

Cron beacons rerun k.php every minute, so the theft repeats constantly. If a victim changes passwords while the system is still infected, the new passwords leak within minutes. With a stolen trunk secret, attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The only exception is when the carrier limits the trunk to the victim’s IP addresses.

The “hima” name matches a backdoor account the malware creates. It also matches a Telegram user Check Point spotted in 2020 sharing a tool that scanned and cracked SIP ranges.

Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded commands still reach 45[.]95[.]147[.]178. The credential upload targets both hosts. Both hosts stopped responding in late September. CRIL is urging law enforcement agencies and national CERTs to work with hosting providers to preserve the server data and sinkhole the addresses.

INJ3CTOR3 Rotates the Indicators Defenders Relied On 

The core JOMANGY code is largely unchanged, but the identifiers defenders were told to hunt for have changed: 

• Watermark: The single April watermark (trace_e1ebf9066a951be519a24140711839ea) has been replaced by per-build values: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e. 
• Gate hash: The MD5 gate hash shared by JOMANGY and ZenharR moved from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a. 
• Takeover script: The /x script grew from 367 to 620 lines, mostly to remove rival actors’ implants and SSH keys. 

The panel can also forge a FreePBX admin session through the ampuser class and setAdmin(). This means changing the admin password does not lock the attacker out. 

Hidden Doors in Compromised FreePBX Systems 

The malware plants an .htaccess file in /var/www/html/admin/views/. It routes any request containing an encoded space or tab, such as %20 or %09, to config.php. Access logs record only the requested path, never the webshell’s filename, so searching logs for the shell by name can come up empty. 

Trunks written directly to /etc/asterisk files such as pjsip_custom.conf also stay invisible in the FreePBX console. Administrators should audit through Asterisk CLI commands such as pjsip show endpoints and compare the results with what the console lists. 

Cleaning Up After INJ3CTOR3 

Shadowserver counted more than 900 compromised FreePBX instances in February 2026, and over 700 were still infected in May. Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised. 

CRIL recommends this order: 

1. Isolate the host from the internet. 
2. Preserve crontabs, logs, and the ampusers table. 
3. Remove the cron entries and the zen2 watchdog. 
4. Delete the eight crontab backups and the login stagers. 
5. Remove extra UID-0 accounts and accounts with $1$nRz1Cbtk$ password hashes. 
6. Delete the 12 webshell copies and the freepbxusers row. 
7. Only then, rotate credentials across all 17 files. 

CRIL’s report-only beagle.sh script can help with triage. Because the operator keeps rotating hashes and hosts, detection based on behavior and file origin will outlast hunting for specific hashes. 

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.

A cyberattack on X users that targeted hundreds of thousands of accounts has prompted an investigation by the US Department of Justice (DOJ), with Attorney General Todd Blanche saying sophisticated cybercriminals attempted to exploit the platform's password-recovery system. The DOJ is working with Elon Musk's X, formerly known as Twitter, to identify those responsible for the attempted attack, according to Blanche's statement on Wednesday. The incident involved hundreds of thousands of X users and was disrupted before the targeted accounts could be captured, Blanche said.

Blanche Says DOJ Is Tracking Those Behind Cyberattack on X Users 

In a statement posted on X, Blanche described the incident as a password-recovery attack carried out by "sophisticated cyber criminals." He said X managed to disrupt the effort and prevent user accounts from being taken over.  Blanche wrote: 

This week, sophisticated cyber criminals attempted a password-recovery attack on hundreds of thousands of X users. X disrupted the attack to prevent user accounts from being captured. But, as we’ve shown, the Justice Department will stop at nothing in its pursuit of cyber fraudsters and scammers. We are working closely with @X to track down the criminals behind this week’s attack. There is no refuge for those that perpetrate their criminal schemes from behind computer screens." 

The attorney general did not disclose additional technical details about the cyberattack on X users, including how the attackers attempted to exploit the recovery system, whether any individual accounts were compromised, or where the suspected criminals were operating from.  The DOJ investigation is intended to identify those responsible for the attempted intrusion, with Blanche emphasizing that authorities would pursue individuals involved in cyber fraud and scams even when those activities are conducted remotely. 

How the Password-Recovery Attack Works 

A password-recovery attack generally targets the systems users rely on when they have forgotten their login credentials. These processes can include "forgot password" features, account-recovery forms, and other mechanisms designed to help legitimate users regain access to their accounts. Attackers may attempt to exploit weaknesses in those processes to obtain access to accounts. In the incident involving X, the platform was able to disrupt the effort before the targeted accounts were captured, according to Blanche. The scale of the attempted cyberattack on X users—hundreds of thousands of accounts—makes the incident notable, although the attorney general did not provide a breakdown of how many accounts were actually affected or whether any users suffered losses. 

AI-Driven Cyberattacks Add to Growing Security Concerns 

The X incident comes against a wider backdrop of increasing cybersecurity threats facing companies and organizations around the world.  Businesses have been dealing with a rise in AI-driven cyberattacks as well as ransomware campaigns capable of stealing sensitive information, interrupting operations, and creating significant financial and operational damage.  The growing use of artificial intelligence in cyber operations has raised concerns that attackers can automate or accelerate parts of their campaigns. At the same time, organizations are exploring ways to use AI-based systems to identify vulnerabilities and strengthen their defenses.  The DOJ has also been pursuing cases involving sophisticated cyber operations. Days before news of the cyberattack on X users, the department announced an operation targeting QTFY, described by US authorities as a Chinese cyberespionage platform. 

DOJ Previously Targeted QTFY Cyberespionage Platform 

According to the Justice Department, QTFY had targeted several US institutions and organizations. Those named by the department included the US Senate, the Federal Reserve, and NASA, among others.  The action against QTFY highlights the broader range of cyber threats confronting US institutions, from espionage operations to attacks aimed at obtaining access to online accounts.  The latest investigation involving X therefore comes amid a broader push by US authorities to identify and disrupt cyber criminals and state-linked cyber operations. 

As per Boston Scientific’s Aug. 30 update, “the unauthorized activity is limited to certain on-premises systems,” providing the clearest indication yet of the scope of the cybersecurity incident that has disrupted the medical device maker’s global network and business operations. Boston Scientific said the investigation into the disruption remains ongoing, with third-party cybersecurity experts. Based on its investigation to date, the company said it has found no indication of unauthorized activity in its environment related to the incident since Aug. 25. The company also clarified that its cloud-based systems and applications have not been affected. The unauthorized activity identified so far is confined to only limited on-premises systems. The clarification comes as Boston Scientific continues working to restore systems supporting manufacturing, ordering and shipping. The company has not established a timeline for a full return to normal operations.

Boston Scientific Ordering and Shipping Recovery Underway 

Boston Scientific said its confidence in restoring ordering, shipping and related system access “continues to increase” and that it is working toward a partial restoration of shipping for some products during the week following its Aug. 30 update. The company said it expects ordering and shipping to ramp up to full capacity once it can demonstrate that the restored operations are fully functional. For now, customers can continue to submit orders electronically through Electronic Data Interchange (EDI) and local applications. Those orders can be placed into a queue for future fulfillment, including orders submitted through the Global Health Exchange (GHX). The latest update indicates that the company’s ability to receive orders electronically has remained intact even while systems required to fulfill and ship those orders have been disrupted. Boston Scientific has not provided a specific date for when full ordering and shipping capacity will return.

Investigation Has Not Confirmed a Data Breach 

Boston Scientific has not said that the cybersecurity incident resulted in a confirmed data breach. Its investigation remains focused on determining the nature, scope, and impact of the unauthorized activity. The Aug. 30 update also provides a more specific picture of the affected technology environment. While certain on-premises systems have been impacted, Boston Scientific said there has been no impact to its cloud-based systems and applications. The company previously said it had found no indication of unauthorized activity in its environment related to the incident since Aug. 25. It has not disclosed whether data was exfiltrated or whether ransomware was involved.

Impact on Medical Devices Remains Limited Based on Current Information

Boston Scientific previously said the incident had not affected devices that are not connected to a Boston Scientific network or clinicians’ ability to use those devices. For Cardiac Rhythm Management (CRM) products, the company reported no known impact on implantable device function, remote monitoring for devices that were already being remotely monitored before the disruption, or programmer interrogations. However, new remote-monitoring activations have been affected. For new CRM implants other than insertable cardiac monitors (ICMs), remote-monitoring communicators cannot currently be activated. As a result, available device data cannot reach remote patient-management systems until activation is possible. Newly implanted ICMs must be activated through the Boston Scientific Clinic Assistant app, but new ICMs cannot currently pair with patients’ remote-monitoring mobile phones. Recorded episodes can still be transmitted through an in-person interrogation using the app’s “Interrogate” function. Boston Scientific said that once its systems are restored and home-monitoring equipment is paired, recorded data will be transmitted to the remote-monitoring system. The company has also said there is no evidence that the affected network environment has increased cybersecurity risks for hospital networks through Boston Scientific devices.

Boston Scientific Continues Incident Response

Boston Scientific said it continues to work with CrowdStrike and other external cybersecurity specialists as the investigation and recovery effort proceeds. The company has been prioritizing systems with the greatest impact on customers and product delivery while working to recover its core business systems. Customers can continue communicating with sales representatives and other Boston Scientific employees through normal channels, including email, established digital platforms and existing connections. The company has acknowledged the potential challenges for customers, patients and suppliers as the disruption continues and thanked them for their patience and partnership. Boston Scientific disclosed the incident in an 8-K filing with the U.S. Securities and Exchange Commission on Aug. 26. The company said it will provide additional updates as appropriate. For now, the latest disclosure narrows the known technical scope of the incident: Boston Scientific says the unauthorized activity is limited to certain on-premises systems, while cloud-based systems and applications remain unaffected. At the same time, the continued disruption to manufacturing, order fulfillment, and shipping means the operational consequences of the attack remain significant as the investigation and recovery effort continue.