Traces of the Chinese-developed AI agent ARTEX were identified in cyberattacks targeting 80 Japanese companies, and the attacks may also have extended to South Korean financial institutions.
An investigation by GMO Security found traces of the AI agent ARTEX on all six overseas servers used in attacks on Japanese companies from the 18th of last month to the 18th of this month. Approximately 80 companies in sectors including insurance, finance and logistics were targeted, and 8 of them announced information leaks.
ARTEX is a Chinese-language-based AI tool that searches for security vulnerabilities in systems. Its developer, “Autumn 27,” recently issued a statement saying that it had confirmed the tool’s misuse and would no longer update it, instead switching to private source code.
Eva Chen, CEO of Trend Micro, said that automated attacks using AI had begun. The number of reported incidents in Japan totaled 607 from January through September, suggesting that attacks may be expanding as AI removes the Japanese-language barrier.
In Japan, a series of disclosures followed, including the leakage of approximately 1.26 million personal-information records from Hankyu Hanshin Department Stores, the possible leakage of up to approximately 540,000 records from NIFTY, and the leakage of 743 records from JETRO. SoftBank suspended some online services after confirming unauthorized connections to some systems.
Meanwhile, attacks using ARTEX were also confirmed against a South Korean financial institution, as the Yomiuri Shimbun reported, citing a report by CrowdStrike. ARTEX configuration files and AI work logs were found on the attack servers.