---
title: GMO Ierae: Chinese-built autonomous AI pentest system ARTEX found in infrastructure attacking about 20 Japanese companies; 8 targeted firms have already disclosed breaches | ctxsec
url: https://ctxsec.com/items/gmo-ierae-artex-ai-pentest-japan-breach-wave
description: "GMO Cybersecurity by Ierae says one attack server behind Japan's recent string of intrusions ran ARTEX, an autonomous AI penetration-testing system. That server targeted about 20 Japanese firms, nine of them in the same industry. Ierae found six more AI-driven attack servers, each focused on particular sectors. Eight of the targeted firms announced data leaks in September and October. The findings have been shared with law enforcement."
status: "confirmed by researcher (GMO Cybersecurity by Ierae blog, Oct 19); victim links not individually confirmed"
published: 2026-10-20
---

> GMO Cybersecurity by Ierae says one attack server behind Japan's recent string of intrusions ran ARTEX, an autonomous AI penetration-testing system. That server targeted about 20 Japanese firms, nine of them in the same industry. Ierae found six more AI-driven attack servers, each focused on particular sectors. Eight of the targeted firms announced data leaks in September and October. The findings have been shared with law enforcement.

[← Context & Harness Attacks](/context) · [markdown](/items/gmo-ierae-artex-ai-pentest-japan-breach-wave.md)

confirmed by researcher (GMO Cybersecurity by Ierae blog, Oct 19); victim links not individually confirmed

2026-10-20

### GMO Ierae: Chinese-built autonomous AI pentest system ARTEX found in infrastructure attacking about 20 Japanese companies; 8 targeted firms have already disclosed breaches

In an Oct 19 follow-up, GMO Cybercrime Center researcher Fukumori writes that investigating attack infrastructure behind intrusions at Japanese companies confirmed the use of **ARTEX**, an AI-driven autonomous penetration-testing system. This backs up Ierae's earlier assessment from forensic logs that the attacks were probably AI-driven. Ierae links it to CrowdStrike's Oct 7 report of ARTEX use against South Korean financial institutions from late September and infers the same method is being used against Japan. Ierae does not explain how it identified ARTEX on the server.

Key points from the post: the infrastructure Ierae examined targeted almost only Japan, at least within what Ierae can observe, hitting about **20 companies, 9 in the same industry**. Following that lead, Ierae found **six more AI-based attack servers** aimed at Japanese firms, each with a main sector focus: digital gifts/retail distribution; education/gifts/printing; point-gift/marketing; insurance/finance; e-commerce/media/logistics; and e-commerce. The post names ARTEX only for the first server, not all six. Of the targeted companies Ierae identified, **8 had already published data-leak notices in September-October 2026**, which it says shows one group behind multiple breaches. No victims, IOCs or attribution are given. Ierae is still checking whether other countries are targeted.

**Why it matters for harness security:** this is a second public case, after NorForge's Cairn report, where an off-the-shelf agentic offensive harness appears to have been run as a campaign, with one host per sector and the same chain retried across look-alike sites. Ierae's earlier Oct 15 post described the pattern as IP rotation just under WAF rate-limit thresholds across hundreds of addresses. If peers in your sector have disclosed breaches recently, assume the same playbook will be tried on you. Patch versions that aren't listed in CVEs as well as listed ones, find externally exposed assets whose versions you can't identify, and don't treat a WAF as a substitute for patching.

Sources: [GMO Cybersecurity by Ierae blog (Oct 19, Japanese)](https://gmo-cybersecurity.com/blog/20261019/) · [CrowdStrike: Unknown threat actor uses AI-driven ARTEX to target South Korean finance (Oct 7)](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) · [Sankei (Oct 20)](https://www.sankei.com/article/20261020-HPL6HXXGDJEBBBMYCRDZ7IRKRE/)