Defense & Security · Asia Pacific

GMO Cybersecurity says Artex was used in attacks on Japanese firms

GMO Cybersecurity by Ierae said its investigation found that the Artex AI tool was used in cyberattacks targeting Japanese companies. The company cited forensic logs, while GMO Internet Group’s security arm said the activity was concentrated almost entirely in Japan and that the tool’s developer would stop updating it.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 2 of 5 outletsHow it's made

View timeline · 5 entries

5 outlets2 regionsLatest reporting Oct 20, 7:39 AM UTC3 min read

Coverage: Mostly CenterL 0 · C 4 · R 1

Updat3 graphic · Map data: Natural Earth Natural Earth (public domain)

What happened

Key facts

GMO Cybersecurity by Ierae said Artex was used in cyberattacks targeting Japanese companies (per The Japan Times, CNA, newsbytesapp.com).
GMO Cybersecurity by Ierae is a subsidiary of GMO Internet Group (per The Japan Times, CNA).
GMO Cybersecurity by Ierae said its finding was based on forensic logs (per The Japan Times, CNA).
Daiki Fukumori of GMO Internet Group said the attacks were almost exclusively aimed at Japan (per CNA, The Japan Times).
GMO Internet Group’s security arm said its investigation with external organisations found six internet servers launching AI-powered attacks (per CNA, The Japan Times).
Artex is described as a Chinese-developed artificial intelligence tool (per CNA, The Japan Times, newsbytesapp.com).
Artex’s developer said the tool was intended for security testing to identify weaknesses and that using it for cyberattacks went against its intentions (per CNA).
Artex’s developer said it would no longer update the project (per CNA).
GMO Cybersecurity by Ierae said the attacks may resemble attacks on South Korean financial organizations reported by CrowdStrike earlier in October 2026 (per The Japan Times).

The brief

GMO Cybersecurity by Ierae said its investigation found that the artificial intelligence tool Artex was used in cyberattacks targeting Japanese companies. The company based its finding on forensic logs, computer-generated records used to investigate security breaches.

GMO Internet Group’s information security arm also said it confirmed Artex’s use after examining the attacks with external organisations. Daiki Fukumori of GMO said the activity was aimed almost exclusively at Japan.

The company’s security arm identified six internet servers launching AI-powered attacks and broadly grouped the apparent targets by industries that included finance, e-commerce and logistics. The sources describe the incidents as attacks on companies, but provide no company-by-company account of the incidents.

Artex’s developer designed the tool for AI-powered security testing intended to identify potential weaknesses, according to the developer’s statement reported by CNA. The developer said malicious users had misused it and that cyberattacks contradicted its intentions. It also said it would no longer update the project.

The developer’s position describes the tool’s intended purpose; it does not independently establish who operated it in these incidents. GMO Cybersecurity by Ierae said the Japanese attacks may resemble attacks on South Korean financial organizations that CrowdStrike reported earlier in October 2026. The link GMO draws is that Artex was involved in both sets of activity.

That comparison is presented as a possibility, rather than as confirmation that the attacks shared operators or other features. The reporting offers two kinds of evidence for the Japanese cases: GMO Cybersecurity by Ierae points to forensic logs, while GMO Internet Group’s security arm says it investigated with external organisations and found six servers launching attacks.

The accounts do not quantify the number of Japanese companies affected or provide a total for customer records exposed. A survey cited by The Japan Times, released by Teikoku Databank earlier that week, found that around one-sixth of Japanese companies had suffered breaches; it is a broader measure and is not identified as a count of Artex-related incidents.

The immediate documented consequence is that Artex’s developer says it will stop updating the tool. The sources do not describe a government decision or a law-enforcement action concerning the alleged attacks.

The Japan Times also reports GMO’s comparison with activity against South Korean financial organizations, while CNA describes the Japanese targeting as nearly exclusive; the two accounts address different aspects and do not establish a contradiction.

Why it matters

Japanese companies in the finance, e-commerce and logistics sectors face the concrete risk of AI-powered attacks; GMO’s security arm identified six servers launching such activity.
Customers of affected Japanese companies could face exposure through security breaches, but the sources do not give an Artex-specific count of companies or exposed records.
The developer’s decision to stop updating Artex changes the project’s stated future support, while the tool had been designed for AI-powered security testing.
GMO Cybersecurity by Ierae’s comparison with reported attacks on South Korean financial organizations makes those organizations a relevant point of comparison, though the company described the relationship as a possible resemblance.

What to watch next

Whether Artex’s developer follows through on its stated decision to stop updating the project.
Whether GMO Cybersecurity by Ierae provides further detail on the forensic logs underlying its finding.
Whether further information clarifies the six servers identified by GMO Internet Group’s security arm and their connection to the attacks.
Whether additional reporting establishes how the Japanese activity compares with the South Korean financial-sector attacks reported by CrowdStrike.

How it's being covered

Coverage analysisShow details

5 source articles · 5 unique outlets

Outlet political mix: Mostly Center· 4 Center · 1 Right

Where the outlets are based: Asia 80% · US/Canada 20%

Outlet political mix

Mostly Center

Left

Center

Right

0 outlets

4 outlets

1 outlet

The marker shows coverage balance: each unique outlet counts once.

Geography

Where the outlets covering this story are based.

5 unique outletsDominant coverage: Asia

All5 US/CA1 · 20%Asia4 · 80%

Coverage imbalance

Coverage is currently concentrated among Center-rated outlets (4 of 5 rated sources); comparatively few Left-rated outlets have published on the event.
Coverage is currently concentrated among outlets based in Asia (4 of 5 geographically-identified sources).

How we measure coverage

2 sources are from a wire service (AP, Reuters, AFP or Bloomberg), whose reporting other outlets often republish.

How outlets' accounts compare

2 framing differences · 2 uncorroborated claims · 2 information gaps

The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 2 reports whose article text Updat3 read; 3 other outlets were checked by headline only.

Framing / emphasis differences

Sources emphasise different angles, actors or consequences of the same reporting.

CNA emphasizes that the attacks were almost exclusively aimed at Japan and reports that GMO’s security arm identified six servers; The Japan Times emphasizes the forensic logs and GMO’s comparison with attacks on South Korean financial organizations.
GMO Cybersecurity by Ierae described the Japanese attacks as potentially similar to the South Korean incidents, but the sources do not establish that the incidents shared operators.

Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.

One-sided or uncorroborated claims

Claims that come from one party or one source family and are not independently corroborated.

GMO Internet Group’s security arm said the attacks were almost exclusively targeting Japan.
Artex’s developer said its use for cyberattacks was contrary to its intentions and that the project would no longer be updated.

Updat3: Not independently corroborated yet — treat as a claim, not an established fact.

Not established by the reporting

Information the available reporting does not contain or confirm. This is a gap, not a disagreement.

The sources do not identify the operators of the attacks or quantify how many Japanese companies were affected by Artex-related incidents.
The sources provide no Artex-specific total for exposed customer records or other measured customer harm.

Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.

Aug 13, 1999
The Act on the Prohibition of Unauthorized Computer Access, enacted on August 13, 1999, criminalized unauthorized access to computer systems.
Background · from our historical context
Nov 6, 2014
On November 6, 2014, Japan enacted the Basic Act on Cybersecurity, establishing national responsibilities and the legal basis for coordinating government cybersecurity policy.
Background · from our historical context
Dec 20, 2018
On December 20, 2018, the United States indicted two Chinese nationals alleged to have worked with China’s Ministry of State Security in a campaign that included the compromise of Japanese technology companies.
Background · from our historical context
2021
Japan publicly attributed a cyberattack on Mitsubishi Electric to a group linked to the Chinese government.
Background · compiled and fact-checked by Updat3
Dec 16, 2022
On December 16, 2022, the Cabinet adopted three security documents, including a new National Security Strategy that called for stronger cyber capabilities.
Background · from our historical context

How we got here

The Act on the Protection of Personal Information, enacted on May 30, 2003, established rules for handling personal data; amendments promulgated on September 9, 2015, strengthened the regime and created the Personal Information Protection Commission.

The Act on the Prohibition of Unauthorized Computer Access, enacted on August 13, 1999, criminalized unauthorized access to computer systems. On November 6, 2014, Japan enacted the Basic Act on Cybersecurity, establishing national responsibilities and the legal basis for coordinating government cybersecurity policy.