The Pulse
GMO Finds ARTEX in Infrastructure Targeting Japanese Firms
GMO Cybersecurity by Ierae says it found the ARTEX penetration-testing system in infrastructure used against Japanese companies. Its investigation identified about 20 targets on one server and six other AI-using attack infrastructures; eigh
AI.info Team · Written with AI · fact-checked ·
Eight Japanese companies identified as targets had disclosed information leaks in September or October, according to a new investigation by GMO Cybersecurity by Ierae. The company says it found ARTEX, an AI-powered penetration-testing system, on infrastructure used in attacks against Japanese firms—but its post does not establish that ARTEX caused each leak.
GMO published its findings on October 19, 2026, as a follow-up to an earlier post that assessed forensic logs as evidence of AI-assisted attacks. The new investigation found one attack infrastructure targeting about 20 Japanese companies, nine of them in the same industry. GMO says it later identified six additional infrastructures using AI and targeting Japanese companies.
ARTEX appeared on the first infrastructure
GMO’s post says investigators confirmed ARTEX on the attack infrastructure they examined in the initial case. The company describes ARTEX as an autonomous penetration-testing system; such tools are designed to test systems for weaknesses, but can be misused against organizations without authorization.
日本企業を狙った侵害事案において攻撃元インフラを調査したところ、AIによる自律型ペネトレーションテストシステムであるARTEXが使われていることを確認いたしました。
Fukumori, GMO Cybercrime Countermeasures Center
Fukumori writes that investigators found ARTEX in infrastructure examined in intrusion cases targeting Japanese firms. GMO does not say in the post that it confirmed ARTEX on each of the six additional AI-using infrastructures, so the findings do not support treating all seven infrastructures as ARTEX deployments.
GMO describes targets across several industries
The six additional infrastructures focused on different sectors, including digital gifts and retail, education and printing, insurance and finance, and e-commerce, media and logistics. The company says the infrastructure it initially examined appeared, within the limits of its observations, to target almost exclusively Japan. It argues that the pattern suggests campaigns organized around particular countries and industries, with separate attacking hosts used for different campaigns.
GMO says eight companies among those it confirmed as targets had issued information-leak disclosures in September or October. It presents the incidents as evidence that one attacking group caused multiple harms and says it shared the information with law-enforcement authorities. The post does not name the companies, specify the volume of data involved or provide evidence tying each disclosed leak to ARTEX itself.
A similar tool surfaced in South Korea
The report compares the Japanese activity with a separate campaign against South Korean financial organizations. CrowdStrike’s October 7 report says ARTEX and large language models were used in activity targeting South Korean financial organizations from late September to early October. CrowdStrike said the activity had not been attributed to a named adversary; its assessment that the actor was likely Chinese-speaking carried moderate confidence.
GMO says the overlap in ARTEX use and observed methods suggests similar tactics in Japan, but it does not identify the Japanese attackers or establish a connection between the Japanese and South Korean operations. It also says it is still investigating whether the activity reaches beyond Japan and South Korea. The firm’s published findings identify about 20 targets on the first infrastructure, six further AI-using infrastructures and eight targeted companies that had disclosed leaks.