A Chinese-developed artificial intelligence tool used against South Korean financial institutions has also been identified in cyberattacks targeting Japanese companies, according to a Japanese cybersecurity investigation.

GMO Cybersecurity by IERAE said on Oct. 19 that investigators confirmed the use of ARTEX, a tool that uses AI to find and exploit weaknesses in computer systems, after examining servers used to attack Japanese businesses.

In an Oct. 21 response to The Epoch Times, GMO clarified that investigators initially discovered one overseas server running ARTEX that had targeted approximately 20 Japanese companies, including nine in the same industry. They subsequently identified five more overseas servers running ARTEX, bringing the total to six servers targeting “approximately 80” Japanese companies across sectors including retail, digital gifts, education, printing, insurance, finance, e-commerce, and logistics.

GMO said eight of the targeted companies had publicly disclosed cyberattacks between Sept. 18 and Oct. 18. It did not name them. Investigators found similarities in ARTEX configurations and the industries targeted, suggesting that the six servers may have been operated by the same group. GMO said it had shared its findings with law enforcement.

Separately, several Japanese businesses operating in those sectors have disclosed substantial data breaches. Lawson, a major convenience store chain, reported that personal information associated with more than 2 million accounts had leaked. Yamato Transport confirmed the theft of about 5.26 million customer information records from its payment-after-delivery service.

In an Oct. 21 response to The Epoch Times, Yamato said it had investigated the breach with outside cybersecurity specialists but declined to disclose the attack methods or tools used, citing security concerns and its dealings with law enforcement.

Another company, GMO Research & AI, which belongs to the same corporate group as GMO Cybersecurity, reported that hackers stole 894,082 personal information records from its infoQ survey platform. The company also confirmed unauthorized exchanges of customer reward points for Amazon gift codes.

None of those companies has publicly established a connection between its disclosed breach and ARTEX.

ARTEX was originally developed for authorized security testing. Unlike conventional tools that require operators to direct each step, it can use AI to plan tests, identify vulnerabilities, and direct other software to exploit them. Those capabilities can also be used to attack systems without permission.

AI Tool Used Against South Korean Banks

The Japanese discovery follows an Oct. 7 report by U.S. cybersecurity company CrowdStrike identifying ARTEX in a campaign targeting South Korean financial organizations from late September to early October.

CrowdStrike examined files left accessible on attacker-controlled servers, including ARTEX settings and records of interactions with Claude Code, an AI coding assistant.

The attacker ran ARTEX primarily with China’s DeepSeek AI model, and additional sessions involved China’s GLM and xAI’s Grok. Recovered conversations included questions about where Korean breach data could be sold and requests for help finding Telegram groups trading such information.

CrowdStrike assessed with moderate confidence that the attacker was likely Chinese-speaking and financially motivated, citing Chinese language instructions and the Chinese-developed tool. It did not identify a named hacking group.

In a broader investigation of financial sector breaches, South Korea’s Financial Services Commission said on Oct. 14 that 16 financial institutions had been affected and approximately 100,000 records containing personal information were leaked.

The exposed information included names, contact details, national identification numbers, and email addresses. The regulator said it had not identified leaks of account passwords or card numbers that would directly enable unauthorized transactions.

Authorities were still examining whether the incidents were connected and whether AI had been involved. Investigators have also not established that the same attacker operated in Japan and South Korea.

Developer Denies Involvement

Chinese cybersecurity company ThreatBook said the original ARTEX tool was developed as a personal project by the product lead of its RedAgents security testing platform.

A developer using the online name Autumn-27 published a statement signed by ARTEX’s author on Oct. 8 condemning the tool’s misuse and denying involvement in the attacks. The statement said ARTEX would stop receiving public updates and maintenance support and become closed-source.

ThreatBook acknowledged that the original open-source version had been misused in several major financial sector security incidents and lacked built-in security controls. Its RedAgents platform includes Artex Pro, a commercial version with additional security controls.

Matt Peverell, CrowdStrike’s director of public relations for Japan and the Asia-Pacific, told The Epoch Times on Oct. 20 that all information the company had to share about the ARTEX-related attacks was already publicly available and that it had nothing further to add.

ThreatBook and the other Japanese businesses contacted for comment did not respond.