Markdown edition

# GMO links ARTEX infrastructure to attacks targeting Japanese firms

> GMO Cybersecurity reports ARTEX use on infrastructure targeting Japanese firms. Its findings identify six systems and about 20 targets within a bounded investigation.

By BIG CHANGE Editorial

Published: 2026-10-20T21:31:38.385Z
Updated: 2026-10-20T21:31:38.385Z
Canonical: https://bigchange.ai/blog/artex-japan-cyberattacks-gmo-investigation

![Conceptual charcoal illustration of unbranded server cabinets receding along a data-centre aisle, with a narrow orange accent on the nearest cabinet.](https://bigchange.ai/api/media/file/artex-infrastructure-concept-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

GMO Cybersecurity says its investigation of attacks on Japanese companies found the use of ARTEX, an AI-assisted penetration-testing tool. In an [October 19 report](https://gmo-cybersecurity.com/blog/20261019/), the company describes six pieces of attack infrastructure that it says chiefly targeted Japanese firms. Its findings put a specific tool behind activity it had previously judged likely to involve AI from forensic logs. The public report does not establish how much of each attack the tool carried out on its own.

## The big change

- **What changed:** ARTEX, a tool built for automated security testing, appears in separate investigations of attacks targeting organizations in Japan and South Korea. GMO's Japanese report moves beyond its earlier suspicion from logs to an identification on attack infrastructure.
- **Why it matters:** A security team investigating a breach now has a concrete account of an AI-assisted tool in the attack environment. Tool traces and infrastructure add context to a breach disclosure, although the presence of ARTEX alone does not establish which actions the software performed.
- **What to watch:** GMO says it is still investigating whether the activity reached countries beyond Japan and South Korea. Further forensic findings and victim disclosures would be needed to establish the campaign's scope and which intrusions share an operator.

## What GMO observed in Japan

GMO says it examined infrastructure used against Japanese companies and confirmed ARTEX use. It identified six attack systems that it assessed as using AI and mainly targeting Japanese firms. Its report groups their principal targets across sectors including retail, education, finance, ecommerce, media and logistics. GMO says one set of infrastructure targeted about 20 Japanese companies, nine of them sites in the same industry. Those figures describe the activity visible to GMO, not a count of every Japanese company attacked or breached.

GMO also says eight of the Japanese companies it had identified as targets had issued information-leak disclosures in September or October 2026. The report treats that pattern as evidence of multiple harms by the same attack group and says it shared its findings with law enforcement. It does not name the companies in this account or publish a company-by-company forensic chain connecting each disclosure to ARTEX. A public disclosure, by itself, does not show that the tool caused the breach.

The October 19 finding follows GMO's [earlier analysis](https://gmo-cybersecurity.com/blog/20261014/) of incidents it had handled. In that earlier post, a researcher said forensic logs made AI use highly likely. The follow-up reports a tool found through infrastructure investigation. It is a more specific observation, although the public summary leaves the tool's precise role in each intrusion unresolved.

## The South Korean case offers context, not attribution

[CrowdStrike reported on October 7](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) that it found ARTEX configuration files and Claude Code session histories on attacker-controlled infrastructure associated with attacks on South Korean financial organizations from late September to early October. It described the actor as unknown. CrowdStrike's findings support the narrower point that attackers have used ARTEX and language models in a separate, documented campaign. They do not identify the operator of the Japanese activity or establish that the same person or group ran both campaigns.

GMO compares the targeting patterns and suggests attackers may have prepared separate hosts for campaigns organized by country and industry. That is GMO's interpretation of the evidence it has seen. [The Japan Times](https://www.japantimes.co.jp/news/2026/10/20/japan/china-ai-cyberattacks/) reported the Japanese finding on October 20, attributing the ARTEX identification to GMO. Neither report establishes an independent measurement of how autonomous the Japanese attacks were.

ARTEX is designed for AI-assisted security testing, a legitimate use when authorized by the system owner. In these reports, investigators say an attacker used it against other organizations. The distinction is the actor's authorization and conduct, not the tool's label. The available public evidence supports a story about observed tool use and selected targets. It does not support a claim that AI independently selected victims, completed every intrusion, or caused all eight disclosed leaks.

## Sources & further reading

- [GMO Cybersecurity's October 19 investigation](https://gmo-cybersecurity.com/blog/20261019/) is the primary account of the Japanese infrastructure, targets and disclosures. Its findings are limited to the activity the company says it could observe.
- [GMO Cybersecurity's earlier incident analysis](https://gmo-cybersecurity.com/blog/20261014/) states an October 15 publication date, despite the URL's date. It explains the researcher's earlier inference of AI use from forensic logs, before the ARTEX identification.
- [CrowdStrike's October 7 investigation](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) documents ARTEX files and language-model session histories in a separate campaign against South Korean financial organizations. It does not identify the operator of the Japanese activity.
- [The Japan Times' October 20 report](https://www.japantimes.co.jp/news/2026/10/20/japan/china-ai-cyberattacks/) provides independent news coverage of GMO's announcement. Its ARTEX finding is attributed to GMO, not a separate forensic investigation.

## Sources

- [GMO Cybersecurity: ARTEX investigation of Japanese attack infrastructure](https://gmo-cybersecurity.com/blog/20261019/) — Primary Japanese-language investigation. Reports ARTEX identification, six similar infrastructures, about 20 Japanese targets including nine same-industry sites, eight target-company leak disclosures, and limits of observation.
- [GMO Cybersecurity: Earlier incident analysis](https://gmo-cybersecurity.com/blog/20261014/) — Earlier Japanese-language post. Describes the researcher's high-confidence inference of AI use from logs before the later ARTEX identification; the page states October 15 despite its URL date.
- [CrowdStrike: Unknown actor uses ARTEX against South Korean finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) — Separate first-party investigation of South Korean activity. Documents ARTEX files and Claude Code histories on attack infrastructure but does not attribute the Japanese campaign.
- [The Japan Times: Chinese AI tool used in cyberattacks on Japanese companies](https://www.japantimes.co.jp/news/2026/10/20/japan/china-ai-cyberattacks/) — Independent news report of GMO's announcement; article excerpt was accessible through search, but full page did not open. GMO attribution is not independent forensic corroboration.