JPCERT/CC Finds AI-Assisted Scanning and API Attacks in Unauthorized-Access Investigation

JPCERT/CC identified evidence of AI-assisted vulnerability scanning and API-based attacks against web services in Japan and other regions while investigating suspected attack infrastructure following disclosures of unauthorized access and personal-information leaks at multiple Japanese organizations. Attackers analyzed Android APK files to identify application APIs and investigate weaknesses such as server-side request forgery (SSRF). The infrastructure contained files associated with the reverse-engineering tools Blutter and jadx, along with a Python HTTPS server configured to issue HTTP 302 redirects.

A separate server, not directly linked to the reported incidents, contained evidence of broader targeting, attempted endpoint detection and response evasion, and web shells suggesting attempted intrusion into internal networks. JPCERT/CC published three IP indicators and recommended removing embedded secrets from applications, enforcing authentication and authorization on the server side, and monitoring and rate-limiting API requests. To reduce SSRF exposure, organizations should validate request destinations after redirects rather than checking only the initial URL. The investigation does not establish a named threat actor or specific vulnerability identifiers.