Confirmed That Many Sources of a Series of Unauthorized Access Attacks Are AI | Security Blog by GMO Cybersecurity by IERAE

What happened

GMO Cybersecurity by Ierae's researchers traced the servers behind attacks on Japanese companies. They found that ARTEX, an AI-driven system that can run penetration tests (tests that try to break into a system) on its own, was being used. Earlier, they had guessed from logs that AI was likely behind the attacks. This new result backs up that guess.

Key facts

• About 20 Japanese companies were targeted by the servers the team examined.
• Nine of those companies were in the same industry.
• The team found 6 more AI-based attack servers that also focused only on Japanese companies.
• Eight targeted Japanese companies had already announced information leaks in September and October 2026.
• CrowdStrike reported that ARTEX was also used in a campaign against South Korean banks and financial firms that began in late September 2026.

Targeted attacks by country and industry

The team says the attacks look planned. Each campaign seems to aim at one country and certain industries. Each campaign also uses its own separate attack servers. As far as the team can see, these servers mostly target Japan. The team is still checking whether other countries are also hit.

Why it matters

AI tools can help attackers find and break into systems faster. Several Japanese companies have already reported data leaks, and the same group may be behind more than one of them. The team has shared its findings with law enforcement to help stop more damage.

What to watch

• Whether attacks outside Japan and South Korea are found.
• More details on who runs the ARTEX attacks.
• New blog posts from the GMO team with updates on their investigation.