GMO links ARTEX to infrastructure targeting Japanese companies

GMO Cybersecurity by Ierae said it confirmed the autonomous penetration-testing system ARTEX in infrastructure used for intrusions targeting Japanese companies. In a wider search, the firm found six AI-enabled attack hosts focused on Japanese companies. The findings extend documented ARTEX use beyond a campaign against South Korean financial organizations.

In its October 19 investigation, GMO said the first infrastructure it examined targeted about 20 Japanese companies and, within the activity the firm could observe, was aimed almost exclusively at Japan. Nine of those targets had websites in the same industry, it said.

Eight companies identified as targets had announced data leaks during September and October 2026, according to GMO. The firm did not name them or publish the addresses of the six hosts. As a result, the counts and any connection between the infrastructure and the disclosed leaks cannot be independently reproduced from public evidence.

ARTEX automates penetration testing, the process of probing systems for security weaknesses. GMO grouped the six AI-enabled hosts by their principal targets: digital gifts and retail distribution; education, gifts and printing; points, gifts and marketing; insurance and finance; ecommerce, media and logistics; and ecommerce.

The Japan finding broadens the documented ARTEX activity against South Korean financial organizations. In an account of that campaign, CrowdStrike said ARTEX and large language models were used from late September to early October and that data was exfiltrated.

CrowdStrike did not attribute the South Korean activity to a named adversary. Nor does the public evidence establish that the Japanese and South Korean activity came from the same actor. GMO presented the similarities as an inference and said it was still investigating whether countries beyond Japan and South Korea were targeted.

GMO said the new finding also supports its earlier forensic assessment that AI was almost certainly used in a recent series of attacks. The firm said it shared the findings with law-enforcement agencies to help prevent further harm.