Japan's NIDS: AI Scales Cyber Attacks, Overwhelming Government Reporting Mechanisms
A new analysis by Japan's National Institute for Defense Studies argues that AI primarily scales and accelerates attacks using known vulnerabilities, challenging existing cross-agency incident reporting systems.
The National Institute for Defense Studies (NIDS) of Japan's Ministry of Defense released a new research analysis on October 30, addressing the series of unauthorized access and data breach incidents in Japan since September. The report, authored by Hayato Sasaki, a special researcher at NIDS' Network Security Laboratory and threat intelligence analyst at JPCERT/CC, offers a new perspective on AI-driven cyberattacks. He notes that while public discussion often focuses on AI's ability to discover unknown vulnerabilities or launch zero-day attacks, recent events show that the primary change brought by AI is not a sudden leap in attack technology, but rather its capacity to scale attacks rapidly, accelerate their pace, and combine multiple techniques to target different systems simultaneously.
According to previous disclosures by JPCERT/CC, these incidents involved various attack methods including exploitation of known vulnerabilities, API abuse, Metabase flaws, and Web Shells. Subsequent investigations confirmed that attackers used AI to scan for known vulnerabilities and attack web services via APIs, with related attack infrastructure also being used against services outside Japan. Sasaki argues that when numerous companies are attacked in quick succession and report to authorities, governments often struggle to quickly identify common attack sources and methods across different incidents. Furthermore, victim companies, busy with their own crisis management, provide limited technical information about the attacks to other security agencies.
The report examines Japan's current cybersecurity incident reporting system, noting that reporting channels are divided by industry regulator, type of compromised information, and attack method. Facing cross-industry, multi-technique automated attacks driven by AI, information tends to be scattered across different agencies, increasing the difficulty of inter-agency integration and analysis, and making it hard for existing response mechanisms to keep up with the speed of attacks. This challenge is not unique to Japan; traditional security alerts often recommend protections for specific vulnerabilities, systems, or industries, which may have limited effect against AI-automated attacks as adversaries can quickly pivot to other vectors.