A Chinese-developed artificial intelligence (AI) tool used against South Korean financial institutions has also been identified in cyberattacks targeting Japanese companies, according to a Japanese cybersecurity investigation.
GMO Cybersecurity by IERAE said on Oct. 19 that investigators confirmed the use of ARTEX, a tool that uses AI to find and exploit weaknesses in computer systems, after examining servers used to attack Japanese businesses.
Investigators found that one set of attack servers targeted approximately 20 Japanese companies, including nine in the same industry. Further investigation uncovered six additional servers using AI to attack businesses in sectors including retail, digital gifts, education, printing, insurance, finance, e-commerce, and logistics.
GMO said its investigation identified eight Japanese companies that announced information leaks in September or October, although it did not name them. The company assessed that multiple incidents involved the same attack group and shared its findings with law enforcement.
Separately, several Japanese businesses operating in those sectors have disclosed substantial data breaches. Lawson, a major convenience store chain, reported that personal information associated with more than 2.15 million accounts had leaked. Yamato Transport confirmed the theft of approximately 5.26 million customer information records from its payment-after-delivery service.
Another company, GMO Research & AI, which belongs to the same corporate group as GMO Cybersecurity, reported that hackers stole 894,082 personal information records from its infoQ survey platform. The company also confirmed unauthorized exchanges of customer reward points for Amazon gift codes.
None of those companies has publicly established a connection between its disclosed breach and ARTEX.
ARTEX was originally developed for authorized security testing. Unlike conventional tools that require operators to direct each step, it can use AI to plan tests, identify vulnerabilities, and direct other software to exploit them. Those capabilities can also be used to attack systems without permission.
AI Tool Used Against South Korean Banks
The Japanese discovery follows an Oct. 7 report by U.S. cybersecurity company CrowdStrike identifying ARTEX in a campaign targeting South Korean financial organizations from late September to early October.
CrowdStrike examined files left accessible on attacker-controlled servers, including ARTEX settings and records of interactions with Claude Code, an AI coding assistant.
The attacker ran ARTEX primarily with China’s DeepSeek AI model, while additional sessions involved China’s GLM and xAI’s Grok. Recovered conversations included questions about where Korean breach data could be sold and requests for help finding Telegram groups trading such information.
CrowdStrike assessed with moderate confidence that the attacker was likely Chinese-speaking and financially motivated, citing Chinese language instructions and the Chinese-developed tool. It did not identify a named hacking group.
In a broader investigation of financial sector breaches, South Korea’s Financial Services Commission said on Oct. 14 that 16 financial institutions had been affected, with approximately 100,000 records containing personal information having been leaked.
The exposed information included names, contact details, national identification numbers, and email addresses. The regulator said it had not identified leaks of account passwords or card numbers that would directly enable unauthorized transactions.
Authorities were still examining whether the incidents were connected and whether AI had been involved. Investigators have also not established that the same attacker operated in Japan and South Korea.
Developer Denies Involvement
Chinese cybersecurity company ThreatBook said the original ARTEX tool was developed as a personal project by the product lead of its RedAgents security testing platform.
A developer using the online name Autumn-27 published a statement signed by ARTEX’s author on Oct. 8 condemning the tool’s misuse and denying involvement in the attacks. The statement said ARTEX would stop receiving public updates and maintenance support and become closed-source.
ThreatBook acknowledged that the original open-source version had been misused in several major financial sector security incidents and lacked built-in security controls. Its RedAgents platform includes Artex Pro, a commercial version with additional security controls.
Matt Peverell, CrowdStrike’s director of public relations for Japan and the Asia-Pacific, told The Epoch Times on Oct. 20 that all information the company had to share about the ARTEX-related attacks was already publicly available and that it had nothing further to add.
GMO Cybersecurity, ThreatBook, and the Japanese businesses mentioned in this report did not respond to requests for comment by publication time.
English (US) · 
Turkish (TR) · 