GMO Cybersecurity by Ierae said it found ARTEX on infrastructure used against Japanese companies.
In an Oct. 19 announcement, the Japanese firm said its investigation with outside organizations confirmed ARTEX’s use after an earlier assessment based on forensic logs. One infrastructure it examined targeted about 20 Japanese companies, nine of them in the same industry, the company said.
GMO later identified six additional attack infrastructures using AI. Based on its observations, those systems also appeared to focus mainly on Japan, with activity across sectors including retail, education, insurance, finance, e-commerce, media and logistics.
Eight companies that GMO identified as targets had announced information leaks during September and October 2026. The company said it shared findings with law enforcement agencies, but did not name the businesses or tie each leak to a specific system. Its announcement did not quantify the data involved or financial losses.
CrowdStrike described ARTEX in an Oct. 7 report as an open-source, agentic penetration-testing tool developed in China. Penetration-testing software is used to assess computer systems for security weaknesses.
CrowdStrike also reported ARTEX configuration files and AI coding-session records on infrastructure linked to a separate campaign against South Korean financial organizations. It said that campaign was active from late September to early October and involved data exfiltration. The report did not establish that the Japanese and South Korean activity had the same operator.
In a separate Oct. 15 advisory, GMO said AI could help attackers search for vulnerabilities and described attacks that rotated through hundreds of IP addresses to evade per-address firewall limits. The advisory did not link those tactics to ARTEX infrastructure.
GMO cautioned that its assessment of Japan as the main target reflected only infrastructure it could observe. The company said it was continuing to investigate whether other countries were targeted and gave no date for a further update.
