A tool built to help companies find their own weak spots appears to have found a second career. On October 19, 2026, Tokyo-based GMO Cybersecurity by Ierae said it confirmed traces of ARTEX, a Chinese-developed AI penetration-testing tool, on servers used to attack Japanese companies.
What GMO Cybersecurity found
The core finding centers on a single piece of attack infrastructure. According to GMO Cybersecurity, it targeted around 20 Japanese companies.
Nine of those companies operate in the same sector.
Eight firms reported data breaches between September and October 2026, a timeline that lines up with the activity on the infrastructure GMO Cybersecurity examined.
The research findings suggest the overlap points to coordinated efforts from a single threat group.
GMO Cybersecurity identified six additional AI-based attack infrastructures aimed at Japanese targets, reaching across retail, education, finance and media.
The South Korea connection
The link to South Korea runs through CrowdStrike. The US cybersecurity firm tied ARTEX to attacks on South Korean banks in late September 2026.
GMO Cybersecurity’s report places the same tool on servers used against Japanese companies, with breach disclosures in Japan clustering across September and October 2026. The timing overlaps with the South Korean activity CrowdStrike flagged.
Attribution remains open
GMO Cybersecurity has shared its security information with Japanese law enforcement. That information did not include specific attribution to a particular actor.
What this means for Japanese companies and beyond
The concentration of nine targets in one industry suggests attackers may be working through sector-specific weaknesses. The six additional attack infrastructures mean retailers, schools, financial firms and media organizations in Japan have a concrete signal that AI-assisted tooling is being pointed at their industries.
For the finance sector specifically, the overlap with South Korean bank attacks is worth noting. Financial institutions in Japan appear on GMO Cybersecurity’s list of targeted industries, and the same tool already has a track record against banks across the water.
The background to the campaign includes a documented exposure of approximately 894,082 records from the GMO Research & AI infoQ survey site, illustrating the scale of data at risk as unauthorized access incidents have risen sharply across Japan since September 2026.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.