Overview
- GMO Cybersecurity reported on Oct 19 that it found traces of ARTEX on attacker infrastructure that targeted roughly 20 Japanese firms and that eight companies disclosed data breaches in September and October.
- CrowdStrike previously tied ARTEX activity to unauthorised access at South Korean banks in late September, creating a cross‑border link between the South Korea and Japan incidents.
- GMO identified six additional AI‑based attack infrastructures aimed at Japan across finance, retail, education and media, suggesting attackers chained multiple AI tools to scale their searches for vulnerabilities.
- GMO has shared technical indicators with Japanese law enforcement but investigators have not publicly attributed the attacks to a named actor, while the government is analysing whether the tool was used maliciously.
- The incidents show how legitimate AI red‑teaming tools can be repurposed for harm, raising risks for firms that must now spend on forensics, remediation and tighter controls of third‑party code and AI access.