Hatena
Not Just ARTEX: How AI Is Involved in Three Attack Infrastructures Targeting Japan
SecurityFirst seen 35 points
A security research team found three attack setups aimed at Japan. Some used AI to do much of the work, and others used AI only in small ways. The team says attackers still look for weak doors, such as old web systems and bad settings.
What happened
Several Japanese companies and groups have recently reported data leaks from their public web systems. Some people blame attacks that use AI. The researchers studied three attack setups that they found on servers the attackers had left open on the internet. Each setup was a full toolkit: scanning tools, target lists, results, and command logs. The researchers say AI was used in each one, but in different amounts.
Key numbers and facts
- Case A: AI ran most of the attack steps by itself. It hit at least 19 organizations, 16 or more of them in Japan.
- Case B: A person led the work, and AI helped plan and build tools. It scanned more than 6,000 Japanese IP addresses and focused hard on a few companies.
- Case C: AI was used only to help write some tools. It looked for weak VPN devices and WebLogic servers, with more than 1,300 WebLogic candidates and 35 or more VPN entry points.
- These numbers are minimum estimates. The real numbers may be higher.
Background
Earlier reports from other security firms described AI-run attack tools, including ARTEX, an AI system that tests computer networks for weak spots. Those reports described attacks aimed at certain countries and industries. The new findings are different. The three setups in this study did not pick one industry. They attacked any outside system that looked easy to break into. Most of the entry points were old web systems and wrong settings that were left open to the public.
Why it matters
AI makes attacks faster and bigger, but it does not change the basic weak spots attackers look for. Organizations should first fix old systems, close exposed services, and correct wrong settings. These basic steps are still the most useful defense.
What to watch
- The researchers plan to publish more detailed reports on each case later.
- Affected organizations are being told through a notice process that is still being prepared.
- Attack details are being shared only with law enforcement, so IP addresses and domains are not published.
Glossary
- ARTEX
- An AI system that automatically tests computer networks to find weak spots, used here as an attack tool.
- VPN
- A private connection tool that lets people use a company network from outside. Weak VPN devices can be an easy way in.
- WebLogic
- A server software product from Oracle that runs business web applications. Old or wrong settings can leave it open to attack.