A Chinese-developed artificial intelligence security tool has been linked to a wave of cyberattacks targeting Japanese companies, weeks after the same technology was connected to breaches at South Korean financial institutions.
Japanese cybersecurity firm GMO Cybersecurity by Ierae said forensic evidence showed that attackers were using Artex, an AI-powered penetration-testing system originally designed to help organisations find vulnerabilities.
The firm said it identified multiple attack servers targeting Japanese companies across sectors including finance, e-commerce, logistics, retail and marketing.
The Japanese government is now examining the incidents and has not ruled out possible involvement by foreign actors.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Artex Found Inside Attack Infrastructure
GMO Cybersecurity said its investigation confirmed that Artex had been running on infrastructure used to attack Japanese companies.
The finding followed an earlier analysis in which the company had suspected that AI was being used based on forensic logs.
Further investigation produced stronger evidence.
GMO said one server it examined had targeted about 20 Japanese companies, including nine from the same industry.
The company later identified six similar attack servers.
Each appeared to focus on particular sectors, including insurance and finance, e-commerce, logistics, digital gifts and retail.
GMO said eight companies it had identified as targets had already disclosed data breaches or suspected information leaks during September and October.
The security firm has shared its findings with law-enforcement agencies.
Around 80 Japanese Companies Reportedly Targeted
The Wall Street Journal reported that approximately 80 Japanese companies were targeted from overseas in attacks carrying digital traces of Artex.
Eight of those incidents occurred within the past month.
The affected companies have not all been publicly named.
Separate reports have linked the recent wave of Japanese cyber incidents to organisations including restaurant chains, transport operators and other large businesses.
Japan’s top government spokesman, Minoru Kihara, said authorities had been discussing the incidents with affected companies.
He said officials were considering all possibilities, including potential involvement by foreign actors.
However, there is currently no public evidence establishing that the Chinese government directed or supported the attacks.
The fact that Artex was developed in China does not by itself establish state involvement.
What Artex Actually Does
Artex was originally created as an AI-powered penetration-testing tool.
Penetration testing is a legitimate cybersecurity practice in which authorised security professionals attempt to break into systems to identify weaknesses before criminals can exploit them.
AI can make that process much faster.
An AI-powered tool can scan networks, identify potential vulnerabilities, test them and adapt its approach without requiring a human operator to manually control every step.
That same capability can become dangerous when used without authorisation.
Instead of helping a company find its own security weaknesses, attackers can point the system at other organisations and automate large parts of the hacking process.
Artex can work with large language models from companies including Anthropic and DeepSeek.
Its developer later restricted access to the tool after reports that pirated or unauthorised copies were being used maliciously.
South Korea Saw Similar Attacks Earlier
Artex had already attracted scrutiny before the Japan campaign.
The420.in previously reported that South Korean financial institutions were targeted in attacks showing traces of the same AI system.
Those incidents reportedly affected several major banks and exposed personal information belonging to tens of thousands of people.
CrowdStrike also linked Artex to a campaign targeting South Korean financial organisations beginning in late September.
GMO Cybersecurity said the Japanese activity appears to share similarities with that operation.
That raises the possibility that the attackers are running separate campaigns focused on specific countries and industries.
Researchers say each campaign may use its own dedicated attack infrastructure.
The identities of the operators remain unclear.
AI Is Lowering the Cost of Cyberattacks
The Artex incidents form part of a broader shift in cybercrime.
AI agents can increasingly carry out tasks that previously required experienced hackers to spend hours manually scanning networks and testing vulnerabilities.
The420.in has already reported another recent campaign in which a single Chinese-speaking hacker used AI agents to attack more than 1,200 websites and successfully compromise over 100.
Researchers estimated the AI usage cost of that campaign at only around $5,000.
That economics changes the threat landscape.
Even if most automated attacks fail, criminals can target thousands of systems at very low cost.
Companies with exposed services, outdated software or weak credentials may therefore face attacks more frequently than before.
Japan is taking the threat seriously.
Officials have called for stronger cybersecurity capabilities as companies continue reporting breaches and AI-assisted intrusion tools become more accessible.
What this means for you:
AI-powered hacking tools can automatically search for weak systems at enormous scale. Businesses should patch internet-facing software quickly, restrict unnecessary access and monitor unusual activity because attacks may now move much faster than traditional manual hacking.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
