GMO Cybersecurity finds Chinese AI tool ARTEX on servers used to hit Japanese firms
In brief
- ARTEX, a Chinese-developed AI tool, left traces on attack servers, GMO Cybersecurity said.
- One attack infrastructure targeted around 20 Japanese companies, nine of them in a single sector.
- Eight firms reported breaches in September and October 2026, overlapping with the infrastructure's activity.
- CrowdStrike tied ARTEX to attacks on South Korean banks in late September 2026.
- GMO shared findings with Japanese law enforcement but didn't attribute the attacks to any actor.
One server, roughly 20 targets
The core of GMO Cybersecurity's findings is one attack infrastructure. Around 20 Japanese companies were in its sights, the firm said, and nine of them operate in the same sector (the report, as relayed by Crypto Briefing, didn't name which one).
Eight firms reported data breaches between September and October 2026. GMO's research points to that window lining up with activity on the infrastructure it examined. It's a timing overlap, not a confirmation that every one of those breaches ran through ARTEX.
The research findings suggest the overlap points to coordinated efforts from a single threat group.
Crypto Briefing said the clustering of nine targets in one industry suggests attackers may have been working through sector-specific weaknesses. It also noted that unauthorized access incidents have risen sharply across Japan since September 2026.
Six more AI-driven setups
The ARTEX server wasn't the only one. GMO Cybersecurity said it identified six additional AI-based attack infrastructures aimed at Japanese targets in retail, education, finance and media.
That's a wide spread of industries.
The South Korea thread, and who's behind it
The tool has turned up outside Japan, too. US cybersecurity firm CrowdStrike tied ARTEX to attacks on South Korean banks in late September 2026, according to Crypto Briefing, and the timing of the Japanese breach disclosures overlaps with the activity CrowdStrike flagged.
Attribution is still missing. GMO Cybersecurity has shared its security information with Japanese law enforcement, but that information didn't attribute the attacks to any particular actor. The report identifies ARTEX as Chinese-developed; it doesn't name the people who used it against these companies.
Frequently asked questions
What is ARTEX and where has it been found?
ARTEX is a Chinese-developed AI penetration-testing tool. GMO Cybersecurity by Ierae said it found traces of it on servers used to attack Japanese companies. Separately, CrowdStrike tied ARTEX to attacks on South Korean banks in late September 2026, according to Crypto Briefing.
Has anyone been blamed for the attacks on Japanese companies?
No. GMO Cybersecurity shared its security information with Japanese law enforcement, but that information didn't attribute the attacks to any particular actor. The research suggested the overlap pointed to a single threat group without naming one.
