ARTEX AI pentest tool tied to attacks on about 20 Japanese companies

Sourcing note: the Japan finding rests mainly on one investigation. GMO Cybersecurity by Ierae, the Tokyo incident response firm called in on many of this autumn's Japanese breaches, reported on October 19, 2026 that it had confirmed ARTEX on attack infrastructure aimed at Japanese companies; GMO named no victims, and its counts cannot be independently reproduced from public evidence. JPCERT/CC and CrowdStrike have independently found AI agent tooling, and ARTEX in South Korea, on related attacker infrastructure, which corroborates the pattern but not each Japan figure, and whether the Japan and South Korea activity came from the same actor is GMO's inference, not an established fact. This item will be updated when named victims, indicators or an official attribution appear.

ARTEX is an open source, Chinese developed autonomous penetration testing tool that connects to a large language model to analyse targets, plan intrusion routes and operate security tools. GMO said the first infrastructure it examined targeted about 20 Japanese companies, nine of them in the same industry, and was aimed almost exclusively at Japan. In a wider search it found six more AI enabled attack servers, each focused on a sector cluster: digital gifts and retail distribution; education, gifts and printing; points, gifts and marketing; insurance and finance; e-commerce, media and logistics; and e-commerce. Eight of the targeted companies had already disclosed data leaks during September and October 2026. GMO shared its findings with law enforcement. The same tool was tied by CrowdStrike to the attacks on South Korean financial firms in late September and early October; its developer halted public releases on October 8, but copies and forks remain in circulation.

Sources: Bloomberg via Stocks24; Data Phoenix; Japan Cyber Watch