Chinese AI tool Artex linked to cyberattacks on 80 Japanese companies

Oct 21, 2026

GMO Cybersecurity reported on October 19, 2026, that a Chinese AI agent named Artex targeted around 80 Japanese companies across sectors like finance, retail, and logistics. Eight targeted firms confirmed data breaches, connecting to earlier AI-driven attacks on South Korean banks reported by CrowdStrike. In response, spokesman Minoru Kihara confirmed official talks with affected companies as Japan declared a cybersecurity state of emergency.

GMO report on Artex attacks in Japan

▪Japanese cybersecurity firm GMO Cybersecurity by Ierae reported on October 19, 2026, that around 80 Japanese companies across retail, insurance, logistics, and finance were targeted in cyberattacks using Chinese-developed AI agent Artex.
▪GMO Cybersecurity identified six distinct server infrastructures using Artex to launch automated cyberattacks against Japanese targets across sectors including finance, retail, and logistics.

Impact on Japanese companies and data breaches

▪A survey by Teikoku Databank released in October 2026 revealed that approximately one-sixth of Japanese companies, including over 30% of large firms, experienced data breaches in 2026.
▪Eight Japanese companies targeted by the Artex cyberattacks published formal statements between September and October 2026 confirming that they suffered data breaches.
▪Recent data breach incidents in Japan affected over 11 million personal records at Burger King operator BK Japan and approximately 894,082 records at GMO Research & AI.

Japanese government responses to AI cyber threats

▪Japan's top government spokesman Minoru Kihara stated on October 20, 2026, that the Japanese government is discussing the Artex attacks with affected companies and investigating foreign involvement.
▪The head of the ruling party's cybersecurity committee in Japan declared in October 2026 that emerging AI-driven cyber threats have pushed the nation into a cybersecurity state of emergency.
▪The head of Japan's National Public Safety Commission stated that police forces must adopt advanced technology and AI tools to combat growing cyberattack threats.

Artex tool development and withdrawal

▪Following cyberattacks in South Korea and Japan, the developer of Artex removed its public source code and ceased project updates to prevent unauthorized misuse.
▪Artex was developed by Chinese engineer Li Puhua in July 2026 as a penetration testing tool that automates security assessments using large language models.

CrowdStrike report on Artex attacks in South Korea

▪CrowdStrike assessed with moderate confidence that the threat actor behind the South Korean bank attacks was a financially motivated Chinese speaker based on tool usage and prompt language.
▪Cybersecurity firm CrowdStrike reported in October 2026 that the Artex AI tool was previously deployed in cyberattacks targeting seven South Korean financial institutions.

NorForge findings on Cairn AI attacks

▪Scanning exposed Cairn control panels, NorForge found hundreds of valid credentials and confirmed active web shell uploaders installed on targeted company servers.
▪Major corporate targets in the Cairn AI agent campaign included farm-equipment manufacturer Deere, appliance company SharkNinja, and engine maker Cummins.
▪Attacks using the Cairn AI framework ran automated break-in tasks averaging under 23 hours per success at an estimated cost of roughly $50 per successful intrusion.
▪NorForge researcher Snorre Fagerland discovered that a Chinese-speaking cybercriminal used open-source AI platform Cairn to target over 1,200 websites belonging to more than 100 companies.

Global warnings on AI cyber threats

▪Anthropic alleged in 2025 that state-sponsored Chinese hackers used its AI technology to automate break-ins targeting roughly 30 global targets, including corporations and foreign governments.
▪The International Monetary Fund warned at its October 2026 annual meeting that cyberattacks using advanced AI agents represent a growing risk to global financial stability.