On October 19, the Japanese GMO Internet Group announced that hackers who recently infiltrated several major Japanese companies were using an artificial intelligence tool called ARTEX developed in China. In late September and early October, multiple Korean banks were also targeted in cyberattacks, orchestrated by ARTEX.
GMO revealed in a blog post from its cybersecurity department on Monday that during an investigation into the attacks on Japanese businesses, they confirmed the use of ARTEX—an AI-based autonomous penetration testing system. The investigation results verified the assumption that the attacks were likely AI-driven, based on evidence logs.
According to Daiki Fukumori, Director of GMO Cybersecurity by Ierae Network Crime Countermeasures Center, the network attacks on Japan originated from the same server infrastructure, with targets primarily concentrated in Japan. Approximately 20 Japanese companies were attacked, with 9 of them belonging to the same industry sector.
The targeted companies include Daiwa Securities Group Inc., East Japan Railway Co. (JR East Japan), and SoftBank Corp. These attacks have prompted Japanese government officials, including the Minister of Digital Affairs, to call for enhanced cybersecurity measures, as the government analyzes the potential malicious use of AI. Japan hosts several key companies in the global tech and industrial supply chain, spanning diverse industries.
GMO’s cybersecurity division also uncovered 6 AI-powered attack servers that appeared to target various industries in Japan, including e-commerce, finance, retail, logistics, media, education, and marketing.
Fukumori, a former Interpol employee, stated that out of the targeted enterprises, 8 had publicly disclosed data breaches within the past two months, indicating a potential connection between the same hacker group and multiple security vulnerabilities and data leaks. The attackers seem to be launching specific network attack operations against different countries and industries.
CrowdStrike Intelligence reported around October 7 that the cyber attacks on Korean financial institutions in late September to early October also involved the use of ARTEX. Therefore, it is suspected that Japanese enterprises are facing attacks utilizing similar methods.
CrowdStrike Intelligence is the threat intelligence analysis department of the U.S. cybersecurity company CrowdStrike, specializing in tracking and analyzing global hacker groups, cybercriminal activities, national-level cyber threats, and emerging attack methods to help businesses and government agencies assess cybersecurity risks and prevent and respond to cyber attacks.
Starting from September 29, several South Korean financial institutions have been targeted in cyberattacks. Shinhan Bank and KB Kookmin Bank detected unusual access activities on the first day, and the following day confirmed personal data breaches, reporting them to financial regulatory authorities. Subsequently, more financial institutions in Korea disclosed being attacked. On October 7, CrowdStrike released an analysis indicating that attackers used ARTEX and other AI tools in their actions against several Korean financial institutions.
CrowdStrike noted in its announcement that the attribution of the attack activity to any known threat actors is currently inconclusive. However, it’s assessed that the threat actors likely have Chinese ties, and the motives behind the attacks are related to economic benefits. This assessment is based on the use of ARTEX, developed in China, and observed clues written in Chinese.
Fukumori stated that GMO’s “White Hat Hacker Team” has provided investigative results to law enforcement agencies and is further investigating whether countries outside of Japan and Korea have also been targeted. The “White Hat Hacker Team” refers to professional cybersecurity personnel who, commissioned by companies or organizations, utilize hacking techniques to identify information system vulnerabilities and enhance network security.
After linking several instances of cyberattacks on Korean financial institutions to ARTEX, the Chinese developer of the tool (known on GitHub as Autumn-27 and identified in reports as Li Puhua) revoked access to source code for programmers and acknowledged the abuse of the tool by “malicious actors.” In a statement, the developer emphasized that using ARTEX for network attacks goes against its original purpose and announced that the project will no longer be updated, transitioning to closed-source as of around October 8.