Learning resource
JPCERT/CC: APK analysis and API probing on attack servers
JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. It reports that the attackers used AI for known-vulnerability scanning and API attacks, and that attack servers held APKs, jadx- and Blutter-related files, APK-extraction directories and an SSRF test script used to probe app APIs. It is a defender’s account of observed attacker tooling with mitigation advice, not a published AI-assisted analysis method or reproducible workflow.
Requirements and limitations
- The reviewed source is the Japanese-language JPCERT/CC Eyes post dated 15 October 2026; no English version was found at the corresponding URL during review. It follows JPCERT/CC’s 8 October alert about personal-data leaks reported by several organizations in Japan, and describes three investigated servers, one of which it states is not directly related to these attacks.
- The post states that JPCERT/CC confirmed AI use for scanning and API attacks, but it does not name the AI system or tooling or explain how AI was applied. The roles of the SSRF script and some files are described as likely rather than confirmed. Findings are illustrated with partial file listings and one script; no samples, logs, prompts or timelines are published.
- Appendix A describes Blutter as an open-source tool for analyzing the Dart AOT-compiled code in Flutter apps, and cites third-party write-ups that combine Frida, Blutter, LIEF and Capstone to recover embedded keys and request-signing logic. These are referenced examples, not JPCERT/CC’s own reproduction.
- Recommended mitigations are to keep API signing keys and long-lived credentials out of apps, to authenticate and authorize users on the server rather than rely on in-app signing or obfuscation, to rate-limit and monitor API use, and to restrict SSRF-prone URL fetches and re-validate redirect destinations. The post also lists three attacker IP indicators.
- The post names jadx and Blutter but no other analysis tools, and documents no REA use. This collection read only the post; the referenced alert, third-party articles and indicators were not separately reviewed.
About this entry
- Type
- Learning resource
- Category
- Learning resources
- Relationship
- Learning resource
- Targets
- App
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.