AI penetration tool ARTEX attacks Japanese companies, affecting police organizations and national projects
Start here
日本安全公司GMO Cybersecurity by Ierae于10月19日公布调查结果,确认针对日本企业的网络攻击使用了中国开发者Autumn-27开发的AI自主渗透测试工具ARTEX,其攻击基础设施几乎只针对日本,瞄准约20家企业,其中9家属同一行业,另发现6台AI攻击主机,涉及金融、保险、电商等行业;此前CrowdStrike曾报道9月下旬韩国金融机构遭同一工具攻击。读卖新闻报道,9月18日至10月18日的攻击使用6台海外服务器,均发现ARTEX使用痕迹,保险、金融、物流等约80家企业遭攻击,其中8家已公布信息泄露,有报道称泄露或波及数百万客户。日本官房长官亦表示将查明该攻击,指或有外国主体参与。10月21日TBS news23报道称,相关个人信息泄露已波及警察组织和国家事业。ARTEX原作者Autumn-27已在韩国金融机构遇袭后关闭源码,网上分叉可能混入恶意软件。
Generated by AI from reports · Updated 4 days ago
Latest developments
- · 1 reportTBS reports that the ARTEX personal information leak affects police organizations and national projects
- · 1 reportAdvises companies not to blindly adopt ARTEX and to switch to white-box testing
- · 1 reportJapan's Chief Cabinet Secretary Says It Will Investigate the Possibility That the ARTEX Attack Involved Foreign Actors
- · 2 reportsChinese-language AI agent ARTEX suspected of being abused in attacks on 80 domestic companies
- · 4 reportsARTEX-class AI penetration tools attack about 20 Japanese companies
Progress timeline
- WebAI Threat Watch (aithreat.io)· Media coverageIn Chinese, as written日本今年前10月外泄信息超3亿条 或系AI无差别攻击(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageChina suspected of attacking AI agents of 80 Japanese companies(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageARTEX AI emerges in attacks targeting Japanese companies; GMO confirms about 20 companies were targeted(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageResearch says the AI tool ARTEX was used to attack Japanese companies.(opens the original post in a new tab)
- TECH+China-made AI tool ARTEX used to attack Japanese companies, with about 20 targets
GMO Cybersecurity by Ierae said on October 19 that attacks targeting Japanese companies were confirmed to have used the China-developed AI autonomous penetration testing system ARTEX, with about 20 companies listed as attack targets. Within its observable scope, the company found that the attack infrastructure almost exclusively targeted Japanese companies, 9 of which were websites in the same industry; it also newly discovered 6 AI attack infrastructures mainly targeting Japanese companies, involving industries including digital gifts, retail distribution, education, printing, finance, insurance, e-commerce, media and logistics. Among the confirmed Japanese companies, 8 disclosed information leaks in September–October 2026; the company believes the same attack group caused multiple victim incidents and has shared the information with law enforcement agencies. ARTEX was open-sourced in July 2026 and was taken down by its developer in October after reports of abuse; CrowdStrike also reported the use of ARTEX in attacks on South Korean financial institutions. The company noted that about 20 is the number of targets of the initial attack infrastructure, not meaning all companies were successfully breached, and that not all of the 6 additionally discovered infrastructures were confirmed to use ARTEX.
- iThome (Taiwan)Japanese companies hit by attacks in succession, GMO confirms attackers used AI penetration testing tool ARTEX
Japanese cybersecurity firm GMO Cybersecurity by Ierae announced investigation results on October 19, confirming that attackers used the AI autonomous penetration testing tool ARTEX to launch attacks on Japanese companies. The investigation found that the attack infrastructure targeted about 20 Japanese companies, of which 9 belonged to the same industry; it also found 6 attack hosts using AI technology, which likewise targeted almost exclusively Japanese companies and each targeted different industries such as digital gifts and retail, insurance and finance, and e-commerce and media logistics. CrowdStrike previously disclosed on October 7 that attacks suffered by South Korean financial institutions from late September to early October also involved ARTEX, and noted that the tool was developed in China and that the attackers may have used Chinese. GMO assesses that the attackers may select targets by country and industry, has confirmed that 8 Japanese companies announced data breaches between September and October, and has provided the relevant investigation information to law enforcement agencies.
- WebAI Threat Watch (aithreat.io)· Media coverageChinese-made AI tool ARTEX attacks Japanese companies; South Korean banks previously hit(opens the original post in a new tab)
- TBS NEWS DIGFollow-up: TBS news23 reports ARTEX-related personal information leaks have spread to police organizations and national projects
A follow-up report by TBS news23 says the personal information leak related to ARTEX has affected police organizations and national projects.
- X@Cyber_Asia_· Discussionhttps://gmo-cybersecurity.com/blog/20261019/(opens the original post in a new tab)
- noteYour company need not rush to use ARTEX for vulnerability checks
The author reminds companies not to rush to use the open-source tool ARTEX for vulnerability checks: the original author, Autumn-27, closed the source code after the South Korean bank incident, and forks online may contain malware. According to a security company's investigation, some recent large-scale attacks have used ARTEX, and cumulative leaks in Japan over two months are said to exceed 160 million records. Defenders should switch to white-box testing, using Shannon or having Claude Code load Cloudflare's security check skill.
- NikkeiJapan's Chief Cabinet Secretary said the ARTEX attack will be investigated, including the possibility of foreign actors.
Japan's Chief Cabinet Secretary commented on the ARTEX attack, saying the attack will be investigated, and noted the possibility that foreign actors were involved.
- AFPBB NewsSelectedJapanese companies hit by cyberattacks, China-developed AI "ARTEX" used
日本安全公司 GMO Cybersecurity by Ierae 10月20日宣布,与外部机构调查后确认,近期针对日本企业的网络攻击使用了中国开发的 AI 网络安全工具 ARTEX。近几周日本已有数十家企业公布遭未授权访问或信息泄露,可能影响数百万客户。该公司称攻击目标几乎集中在日本,并发现 6 台发动 AI 攻击的服务器,大致按金融、电商、物流等行业分类,服务器所在地和运营者未公开,相关信息已共享给执法机构。ARTEX 开发方称该工具本用于 AI 安全测试、发现潜在漏洞以帮助组织加强防御,在韩国多家金融机构遇袭与其关联被指出后,开发方本月承认工具被恶意攻击者滥用,使开发者无法访问源代码,并宣布不再更新该项目。
- WebAI Threat Watch (aithreat.io)· Media coverageCyberattaque: Un IA chinoise a piraté des millions de données au Japon(opens the original post in a new tab)
- BlickSelectedCyberattack: Chinese AI tool Artex used to attack Japanese enterprises; data of millions of customers may have leaked
The security division of GMO Internet Group confirmed that the Chinese AI cybersecurity tool Artex was used in a series of cyberattacks targeting Japanese enterprises, and that unauthorized access and data leaks reported by dozens of Japanese enterprises may affect millions of customers. GMO's Daiki Fukumori said the attacks targeted almost exclusively Japan; his team identified six servers launching AI-driven attacks, roughly categorized by industry such as finance, e-commerce and logistics, without stating the servers' locations or operators, and the information has been submitted to authorities. Artex was developed by Autumn-27 and was originally designed to use AI-driven security testing to find system weaknesses; after South Korea linked it to multiple intrusions at financial institutions, the tool stopped offering open-source access starting this month, and the developer said the project will no longer be updated and is moving to closed source. The Japanese government has called on enterprises to strengthen cyber defenses.
- WebAI Threat Watch (aithreat.io)· Media coverageHackers use open-source AI security tool originating from China; about 80 Japanese companies listed as targets(opens the original post in a new tab)
- Yomiuri ShimbunSelectedAbout 80 Japanese companies suffer information leaks from cyberattacks, Chinese AI agent suspected of being abused
Japanese security company GMO Cyber Security by Ierae, after being commissioned by victim companies to investigate, said that attacks on Japanese companies between September 18 and October 18 used 6 overseas public servers, and traces of use of the Chinese AI agent ARTEX were found on all 6 servers, while no traces of other AI agents were found, and therefore it believed there was a high possibility that ARTEX was used in the attacks. About 80 companies in insurance, finance, logistics and other sectors were attacked, of which 8 have announced that information leaks actually occurred. ARTEX was released on an internet technology information sharing service in July of this year by a developer using Chinese, and is known for being able to comprehensively explore system vulnerabilities.
- X@munini_atto· Discussionhttps://gmo-cybersecurity.com/blog/20261019/(opens the original post in a new tab)
- GMO Cybersecurity by IeraeSelectedGMO follow-up investigation: ARTEX-class AI penetration tools attack about 20 Japanese companies
GMO 网络安全犯罪对策中心(GMO サイバー犯罪対策センター)调查针对日本企业的侵害事件攻击源基础设施后确认,其中使用了 AI 自主渗透测试系统 ARTEX,印证了此前基于取证日志推测的 AI 攻击判断。该机构称,此前观察到的攻击源基础设施几乎只针对日本,此次调查的基础设施瞄准约 20 家日本企业,其中 9 家属于同一行业;结合 CrowdStrike 关于 2026 年 9 月下旬韩国金融机构遭同一工具攻击的报道,其推断这是按国家和行业筛选目标的攻击活动,且每次活动使用不同的攻击主机。该机构据此进一步发现 6 台同样以日本企业为目标的 AI 攻击基础设施,主要针对数字礼品与零售流通、教育与印刷、积分礼品与营销、保险与金融、电商与媒体物流、电商等行业。已确认被瞄准的日本企业中,2026 年 9 至 10 月已有 8 家发布信息泄露公告。
Related discussion
- X@SFTechCEO · SFTechCEOARTEX attack infrastructure. ARTEX is a Chinese-developed, LLM multi-agent autonomous penetration-testing system (by Au…(opens the original post in a new tab)
1 likes·Oct 30 07:41Collect
- WebAI Threat Watch (aithreat.io)In Chinese, as written日本今年前10月外泄信息超3亿条 或系AI无差别攻击(opens the original post in a new tab)
- Older than 72 hours · Not included in the 72-hour figures
- X@aditya49 · Aditya TallapragadaChinese tool Artex AI connected to attacks on Japan https://www.thestar.com.my/tech/tech-news/2026/10/20/ai-tool-that…(opens the original post in a new tab)
- WebITmedia AI+What is the cyberattack AI tool "ARTEX"? Also used by attackers linked to the Chinese government, with abuse confirmed in various countries(opens the original post in a new tab)
- X@Rachidmarcil · Ai news🔥 ARTEX: open-source Chinese AI attack tool spotted in the wild. GMO IERAE found its traces on 6 attacker servers hitti…(opens the original post in a new tab)
1 comments·Oct 24 19:44Collect
- X@SYNCONJP · SYNCON(シンクオン)AI tools meant to protect were on the attack side; GMO confirmed ARTEX as the attack source. About 20 companies with 1 machine, plus 6 more machines. 8 targeted companies have disclosed leaks. If it remains "we're small," inspections will be delayed. https://syncon.jp/a…(opens the original post in a new tab)
- X@TanArrowz · ArrowzAsia-based cybersecurity specialists say more hackers are using AI tools including Artex against companies in areas suc…(opens the original post in a new tab)
- X@cutplaza · cutplaza(麗華)🌺花の妖怪かっぷらさんPrivileges seized in under 3 hours after being targeted — the AI "ARTEX" abused by Chinese-linked hackers, and its relationship to attacks on Japanese companies | cutplaza ▶https://note.com/cutplaza/n/n975612894b61◀ "Noticing something unusual and responding…"(opens the original post in a new tab)
- X@cybermsi · CyberMSI - Leader in Microsoft CybersecurityAn AI agent is now linked to attacks on roughly 80 Japanese companies. A report from GMO Cybersecurity by Ierae found…(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)China suspected of attacking AI agents of 80 Japanese companies(opens the original post in a new tab)
- WebGigazineMicrosoft's investigation found that cyberattackers linked to the Chinese government had used the AI agent "ARTEX" to carry out attacks against hundreds of organizations worldwide(opens the original post in a new tab)
- X@MAGAsFix · MAGA’s the Fix™The CCP wants to dominate the world. A Chinese AI penetration-testing tool called ARTEX has been found on servers used…(opens the original post in a new tab)
44 likes · 2 comments·Oct 24 04:34Collect
Attention trend
New sources per day
- Oct 19: 18 new sources (1 outlets, 17 accounts)
- Oct 20: 54 new sources (3 outlets, 51 accounts)
- Oct 21: 21 new sources (6 outlets, 15 accounts)
- Oct 22: 9 new sources (1 outlets, 8 accounts)
- Oct 23: 6 new sources (0 outlets, 6 accounts)
- Oct 24: 1 new sources (0 outlets, 1 accounts)
- Oct 25: 0 new sources (0 outlets, 0 accounts)
- Oct 26: 0 new sources (0 outlets, 0 accounts)
- Oct 27: 0 new sources (0 outlets, 0 accounts)
- Oct 28: 0 new sources (0 outlets, 0 accounts)
- Oct 29: 1 new sources (0 outlets, 1 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)