Approximately 20 Japanese companies are believed to have been targeted in attacks using ARTEX, an AI-powered autonomous intrusion tool. Multiple attacks may have originated from the same group, and security gaps have also been identified.
GMO Internet Group's investigation confirmed that ARTEX, an AI-powered autonomous penetration testing system, was used in a series of unauthorized-access incidents targeting Japanese companies. The attack infrastructure targeted approximately 20 Japanese companies, suggesting that the incidents may have been carried out by the same group.
A comparison with a CrowdStrike report found that the tactics used in the ARTEX attacks were similar to an incident targeting a South Korean financial institution, and are believed to have spread to Japanese companies as well. Approximately 9 of the companies targeted are said to have operated websites in the same industry, raising the possibility that activity by the same group caused multiple incidents.
The number of companies that publicly disclosed data breaches reached 8, and the group's activity may have been concentrated in September and October last year. The investigation was shared with law enforcement, and the need to strengthen defensive measures has been highlighted.
Three security gaps have been identified: vulnerabilities affecting versions other than those listed in CVEs, difficulty in recognition caused by ASM asymmetry, and techniques for bypassing security equipment, including WAFs.