{
  "added_at": "2026-10-19",
  "category": "learning",
  "description_en": "JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. It reports that the attackers used AI for known-vulnerability scanning and API attacks, and that attack servers held APKs, jadx- and Blutter-related files, APK-extraction directories and an SSRF test script used to probe app APIs. It is a defender’s account of observed attacker tooling with mitigation advice, not a published AI-assisted analysis method or reproducible workflow.",
  "description_zh": "JPCERT/CC 于 2026 年 10 月 15 日发布的博客文章，调查日本国内一系列不正当访问事件背后的攻击基础设施。文章报告攻击者利用 AI 扫描已知漏洞并经由 API 发动攻击，攻击服务器上存有 APK 文件、与 jadx 和 Blutter 相关的文件、APK 解包目录，以及用于探测应用 API 的 SSRF 验证脚本。这是防御方对所观察到的攻击者工具的记述并附缓解建议，而非公开的 AI 辅助分析方法或可复现的工作流程。",
  "entry_url": "https://awesomerea.org/resources/jpcert-apk-api-attack-infrastructure-report/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/jpcert-apk-api-attack-infrastructure-report/",
  "evidence_url": "https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html",
  "group": "learn",
  "id": "jpcert-apk-api-attack-infrastructure-report",
  "json_url": "https://awesomerea.org/resources/jpcert-apk-api-attack-infrastructure-report/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/jpcert-apk-api-attack-infrastructure-report/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/jpcert-apk-api-attack-infrastructure-report/index.md",
  "name": "JPCERT/CC: APK analysis and API probing on attack servers",
  "name_zh": "JPCERT/CC：攻击服务器上的 APK 解析与 API 探测",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "The reviewed source is the Japanese-language JPCERT/CC Eyes post dated 15 October 2026; no English version was found at the corresponding URL during review. It follows JPCERT/CC’s 8 October alert about personal-data leaks reported by several organizations in Japan, and describes three investigated servers, one of which it states is not directly related to these attacks.",
    "The post states that JPCERT/CC confirmed AI use for scanning and API attacks, but it does not name the AI system or tooling or explain how AI was applied. The roles of the SSRF script and some files are described as likely rather than confirmed. Findings are illustrated with partial file listings and one script; no samples, logs, prompts or timelines are published.",
    "Appendix A describes Blutter as an open-source tool for analyzing the Dart AOT-compiled code in Flutter apps, and cites third-party write-ups that combine Frida, Blutter, LIEF and Capstone to recover embedded keys and request-signing logic. These are referenced examples, not JPCERT/CC’s own reproduction.",
    "Recommended mitigations are to keep API signing keys and long-lived credentials out of apps, to authenticate and authorize users on the server rather than rely on in-app signing or obfuscation, to rate-limit and monitor API use, and to restrict SSRF-prone URL fetches and re-validate redirect destinations. The post also lists three attacker IP indicators.",
    "The post names jadx and Blutter but no other analysis tools."
  ],
  "requirements_zh": [
    "所审阅来源是 JPCERT/CC Eyes 于 2026 年 10 月 15 日发布的日文文章；审阅时在对应网址未找到英文版本。文章承接 JPCERT/CC 于 10 月 8 日就日本多个组织相继公布的个人信息泄露事件发布的预警，介绍了三台被调查的服务器，并说明其中一台与这些攻击没有直接关系。",
    "文章称 JPCERT/CC 已确认攻击者利用 AI 进行扫描和 API 攻击，但未指明所用的 AI 系统或工具，也未说明 AI 的具体用法。SSRF 脚本及部分文件的用途以“可能”而非“已确认”的措辞描述。文章以部分文件清单和一段脚本作为图示，未公开样本、日志、提示词或时间线。",
    "附录 A 将 Blutter 介绍为用于分析 Flutter 应用中 Dart AOT 编译代码的开源工具，并援引第三方文章：这些文章结合 Frida、Blutter、LIEF 与 Capstone，恢复了内嵌密钥与请求签名逻辑。这些是援引的案例，并非 JPCERT/CC 自行复现。",
    "文章建议的缓解措施包括：不在应用中嵌入 API 签名密钥和长期有效的凭据；在服务器端对用户进行认证和授权，而不是依赖应用内签名或混淆；对 API 使用进行速率限制与监控；限制易受 SSRF 影响的外部 URL 获取，并重新校验重定向目标。文章还列出了三个攻击者 IP 指标。",
    "文章提到 jadx 与 Blutter，未提及其他分析工具。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}