Skip to navigation

Threat reportThreat IntelligenceTL-2026-4723

ARTEX China-developed agentic AI penetration-testing tool used in attacks on Japanese companies (and South Korean financial institutions)

highACTIVE

GMO Cybersecurity by Ierae traced attacks on roughly 20 Japanese companies to attacker infrastructure running ARTEX, an open-source, China-developed agentic AI penetration-testing tool that drives LLMs for reconnaissance and vulnerability verification. Eight targeted companies disclosed data leaks in September-October 2026; the same tool was documented by CrowdStrike in a parallel campaign against South Korean banks. First disclosed .

Key facts for ARTEX AI pentest tool

IdentifiersTL-2026-4723
Also known asARTEX
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsVarious Internet-facing web applications, APIs and mobile-backend services of Japanese and South Korean organizations
MalwareDataleak, GROK
ToolsARTEX, Blutter, Claude Code, jadx
MITRE ATT&CK techniquesT1090 Proxy, T1190 Exploit Public-Facing Application, T1583.003 Virtual Private Server, T1588.002 Tool, T1588.007 Artificial Intelligence, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorsfinance, insurance, logistics, retail, ecommerce, news - media, education, marketing, transport
Target regionsjapan, south korea
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for ARTEX AI pentest tool

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4723 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX-Style LLM-Agent Web Reconnaissance Burst — Exploitation Phase

Detects high-volume, high-diversity web requests with a high 4xx ratio from a single client in a 5-minute window, the footprint of an agentic AI pentest tool such as ARTEX driving automated reconnaissance and vulnerability verification against internet-facing applications (T1595.002 leading to T1190). Also matches the CrowdStrike-reported ARTEX host 38.244.50.120. Thresholds are behavioural and must be tuned per site; the IP is from the South Korean campaign and was not confirmed in the Japan campaign.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1595.002, T1190
  • Data sources: web_access_logs (index=web, sourcetype=access_combined), W3CIISLog
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-24h ```ARTEX-style LLM-agent recon (TL-2026-4723): many distinct paths with a high 4xx ratio from one client, or the CrowdStrike-reported ARTEX host 38.244.50.120```
| bin _time span=5m
| stats count AS requests dc(uri_path) AS distinct_paths count(eval(status>=400)) AS errors by _time clientip
| eval error_ratio=round(errors/requests,2)
| where (requests>=300 AND distinct_paths>=100 AND error_ratio>=0.3) OR clientip="38.244.50.120"
| table _time clientip requests distinct_paths errors error_ratio

Microsoft KQL

// TL-2026-4723 ARTEX-style LLM-agent web reconnaissance burst
W3CIISLog
| where TimeGenerated > ago(24h)
| summarize requests = count(), distinct_paths = dcount(csUriStem), errors = countif(toint(scStatus) >= 400) by cIP, bin(TimeGenerated, 5m)
| extend error_ratio = round(todouble(errors) / requests, 2)
| where (requests >= 300 and distinct_paths >= 100 and error_ratio >= 0.3) or cIP == "38.244.50.120"
| project TimeGenerated, cIP, requests, distinct_paths, errors, error_ratio

Sigma

title: ARTEX-Style API Discovery Probing or Known ARTEX Host Access
id: 6f0d3a52-8c1e-4b7a-9d21-4e5a7c3b1a01
status: experimental
description: Detects web requests from the CrowdStrike-reported ARTEX host or requests for API documentation and schema endpoints, a common first step of agentic AI reconnaissance (TL-2026-4723). Behavioural volume thresholds are implemented in the SPL and KQL forms.
references:
  - https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
  - https://www.nippon.com/en/news/yjj2026102000795/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_ioc:
    c-ip: '38.244.50.120'
  selection_discovery:
    cs-uri-stem|endswith:
      - '/openapi.json'
      - '/swagger.json'
      - '/v2/api-docs'
      - '/v3/api-docs'
      - '/swagger-ui.html'
      - '/graphql'
  condition: 1 of selection_*
falsepositives:
  - Authorised vulnerability scanners and API developers
  - Legitimate API clients that fetch OpenAPI schemas
level: medium

Known false positives:

  • Authorised vulnerability scanners and red-team engagements generating bursts of distinct paths
  • Search-engine crawlers or uptime monitors behind shared NAT or CDN egress IPs

Tuning notes: Adjust the requests, distinct_paths and error_ratio thresholds to your baseline. Exclude approved scanner IPs and CDN or WAF egress ranges. If a reverse proxy fronts the site, use the X-Forwarded-For client field instead of clientip. Treat the 38.244.50.120 match as a high-priority lead regardless of thresholds, but note it is unconfirmed for the Japan campaign.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Automated Identifier Enumeration Against Lookup Services — Exploitation Phase · unlock with TL Creds
  • ARTEX and Claude Code Agent Artifacts on Disk — Post-Exploitation Phase · unlock with TL Creds
  • Server Egress to LLM API Providers or [indicator] Proxy — C2 and Proxy Phase · unlock with TL Creds
  • Sensitive Configuration and Secret File Probing by Automated Scanner — Exploitation Phase · unlock with TL Creds
  • Android and Flutter Reverse-Engineering Tools (jadx, Blutter) on Servers — Post-Exploitation Phase · unlock with TL Creds
  • DNS Resolution of [indicator] LLM API Proxy — C2 and Proxy Phase · unlock with TL Creds
  • ARTEX or Claude Code Agent Process Execution on Server — Post-Exploitation Phase · unlock with TL Creds
  • Traffic To or From Reported ARTEX Host [indicator] — C2 and Proxy Phase · unlock with TL Creds

Indicators of compromise for ARTEX AI pentest tool

As of 2026-10-29, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-4723.

Sample indicators (2 of 16)

  • IP address: 38.244.50[.]120
  • Domain: xcai[.]pro

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

How ARTEX AI pentest tool works

On 2026-10-19 GMO Cybersecurity by Ierae (a GMO Internet Group subsidiary) announced that ARTEX, an AI-autonomous penetration-testing system developed in China, had been identified in attack-source infrastructure used against Japanese companies. One infrastructure targeted about 20 companies, nine of them in the same industry sector, and the campaigns were described as country- and industry-specific, with separate attack hosts per campaign. GMO's researcher Daiki Fukumori said the attacks came from a single server infrastructure aimed almost exclusively at Japan. Six AI-enabled attack servers were reported. Eight targeted companies publicly disclosed information leaks within about two months (September-October 2026). Named targets in press coverage include Daiwa Securities Group, East Japan Railway and SoftBank. Reported sectors: finance, insurance, logistics, retail, e-commerce, media, education, marketing, digital gifts and printing. One report cites Japanese attacks occurring between 2026-09-18 and 2026-10-18 and a broader analysis suggesting up to ~80 possible targets; this is not corroborated by the other fetched sources. GMO shared its findings with law enforcement.

ARTEX is open-source software first unveiled in July 2026 that connects to large language models so an agent performs reconnaissance, vulnerability research and verification largely autonomously. It was built for authorized security testing. GMO identified it through ARTEX configuration files and AI agent session histories left on attacker infrastructure. Reporting is inconsistent on whether ARTEX was confirmed on every one of the six servers; at least the initial infrastructure was confirmed.

The tool was previously documented by CrowdStrike (published 2026-10-07) in attacks on South Korean financial institutions (Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram Savings, Welcome Savings, Hyundai Capital), where an actor combined ARTEX with DeepSeek v4.1-flash (primary backend), GLM-5.3 and Grok 4.6, likely reached through the API proxy/reseller xcai.pro, and with Anthropic's Claude Code. Exposed open directories held Claude Code session histories, ARTEX configuration files, Claude memory files and a CLAUDE.md with a Chinese-language pentesting prompt. CrowdStrike listed an ARTEX host at 38.244.50.120, nine proxy IPs and a Hong Kong primary server, and noted the actor made basic operational-security mistakes. Targets there were auxiliary systems such as loan-inquiry services and employee mobile support systems with known vulnerabilities, missing MFA or patches, and lookup services lacking identity verification; at least 68,000 people's data was exposed.

Attribution is unresolved. GMO and secondary reporting caution that public evidence does not establish a single operator across all incidents or a link between the Japanese and Korean campaigns; GMO characterised the CrowdStrike comparison as context, not proof, and tool origin does not indicate operator nationality or state involvement. The Korean-campaign suspect was reported as a 26-year-old in Guangdong who denied involvement. After the misuse became public, the ARTEX developer announced the project would go closed-source with no further public releases and took down the GitHub page (announced Thursday, reported as around 2026-10-08), but previously released source and English/Korean-language derivatives remain usable. No malware hashes, CVEs or Japan-campaign IPs/domains were published.

MITRE ATT&CK techniques by tactic:

Command and Control

T1090 Proxy

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1583.003 Virtual Private Server; T1588.002 Tool; T1588.007 Artificial Intelligence

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for ARTEX AI pentest tool

Patches

  • Apply current vendor patches to all internet-facing web servers; no CVE was published for this activity

Immediate actions

  • Inventory and review internet-facing systems, APIs and legacy applications, including auxiliary services such as loan-inquiry and employee mobile-support systems
  • Preserve access, authentication and database-operation logs and investigate suspected breaches for data exfiltration
  • Hunt for traffic to xcai.pro and 38.244.50.120 and for high-volume automated scanning consistent with LLM-agent-driven recon

Workarounds

  • Restrict SSRF exposure through destination validation
  • Block or alert on known ARTEX infrastructure indicators at the perimeter

Longer-term hardening

  • Prioritise application-layer patching over reliance on WAF-only protection
  • Enforce server-side authorization checks and identity verification on lookup services
  • Monitor API activity with rate limiting and anomaly detection
  • Require MFA on all externally reachable administrative and employee-facing services
  • Do not embed private keys or secrets in mobile applications

Affected and fixed versions

  • Various — Internet-facing web applications, APIs and mobile-backend services of Japanese and South Korean organizations
    Vulnerable versions: Unpatched or lacking MFA / server-side authorization

Timeline of ARTEX AI pentest tool

  • locked-ioc-15 open-source agentic pentesting tool first unveiled (July 2026; day not specified in sources)
  • Per CrowdStrike, infrastructure testing and tool assembly for the South Korean campaign began (August 2026; day not specified)
  • Start of the attack window against Japanese companies reported by one outlet (2026-09-18 to 2026-10-18); eight companies later disclosed data leaks in September-October
  • ARTEX-driven campaign against South Korean financial institutions active from late September 2026 (exact day not specified)
  • CrowdStrike publishes findings on locked-ioc-15 combined with DeepSeek, GLM, Grok and locked-ioc-11 against South Korean banks
  • locked-ioc-15 developer announces the project is closed-source with no further public releases and takes down the GitHub page, citing misuse (announced on a Thursday)
  • Recorded Future reports detailed tracking of the ARTEX-related activity
  • GMO Cybersecurity by Ierae confirms locked-ioc-15 on attack infrastructure used against ~20 Japanese companies and shares findings with law enforcement
  • Jiji Press/Nippon.com and Insurance Journal report the findings, naming Daiwa Securities Group, East Japan Railway and SoftBank among targets

Sources cited for ARTEX AI pentest tool

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats