In an Oct 19 follow-up, GMO Cybercrime Center researcher Fukumori writes that investigating attack infrastructure behind intrusions at Japanese companies confirmed the use of ARTEX, an AI-driven autonomous penetration-testing system. This backs up Ierae's earlier assessment from forensic logs that the attacks were probably AI-driven. Ierae links it to CrowdStrike's Oct 7 report of ARTEX use against South Korean financial institutions from late September and infers the same method is being used against Japan. Ierae does not explain how it identified ARTEX on the server.

Key points from the post: the infrastructure Ierae examined targeted almost only Japan, at least within what Ierae can observe, hitting about 20 companies, 9 in the same industry. Following that lead, Ierae found six more AI-based attack servers aimed at Japanese firms, each with a main sector focus: digital gifts/retail distribution; education/gifts/printing; point-gift/marketing; insurance/finance; e-commerce/media/logistics; and e-commerce. The post names ARTEX only for the first server, not all six. Of the targeted companies Ierae identified, 8 had already published data-leak notices in September-October 2026, which it says shows one group behind multiple breaches. No victims, IOCs or attribution are given. Ierae is still checking whether other countries are targeted.

Why it matters for harness security: this is a second public case, after NorForge's Cairn report, where an off-the-shelf agentic offensive harness appears to have been run as a campaign, with one host per sector and the same chain retried across look-alike sites. Ierae's earlier Oct 15 post described the pattern as IP rotation just under WAF rate-limit thresholds across hundreds of addresses. If peers in your sector have disclosed breaches recently, assume the same playbook will be tried on you. Patch versions that aren't listed in CVEs as well as listed ones, find externally exposed assets whose versions you can't identify, and don't treat a WAF as a substitute for patching.