InfraHunter identified six campaigns through public directories. Domains associated with Daikin Industries and Nidec were listed as reconnaissance targets, but no compromise was confirmed. Approximately 2,500 LLM API gateways worldwide were identified as potential targets, and reconnaissance and attempted exploitation were observed across multiple regions.
On 13 September 2026, InfraHunter reported identifying six activities across attack infrastructure worldwide, starting with two public directories found on a Singapore-based VPS. The attackers were reportedly conducting reconnaissance and attempting unauthorized use of a range of assets in the same environment, including _self-hosted_ LLM API gateways. These activities have been analyzed as being attributable to one person or the same environment.
As reconnaissance related to Japanese companies, domains associated with the Daikin Industries group (daikin.com and daikincomfort.com) among 14 data center cooling and thermal management companies, as well as embraco.com, associated with Nidec subsidiary Embraco, were listed. In practice, however, the activity was limited to subdomain enumeration and checks for active systems, and no compromise was confirmed.