# ARTEX China-developed agentic AI penetration-testing tool used in attacks on Japanese companies (and South Korean financial institutions)

> GMO Cybersecurity by Ierae traced attacks on roughly 20 Japanese companies to attacker infrastructure running ARTEX, an open-source, China-developed agentic AI penetration-testing tool that drives LLMs for reconnaissance and vulnerability verification. Eight targeted companies disclosed data leaks in September-October 2026; the same tool was documented by CrowdStrike in a parallel campaign against South Korean banks.

- **Published:** 2026-10-29T09:21:52Z
- **Last reviewed:** 2026-10-29T09:21:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4723
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4723.png
- **ID:** TL-2026-4723
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (2 shown free below)

## Description

On 2026-10-19 GMO Cybersecurity by Ierae (a GMO Internet Group subsidiary) announced that ARTEX, an AI-autonomous penetration-testing system developed in China, had been identified in attack-source infrastructure used against Japanese companies. One infrastructure targeted about 20 companies, nine of them in the same industry sector, and the campaigns were described as country- and industry-specific, with separate attack hosts per campaign. GMO's researcher Daiki Fukumori said the attacks came from a single server infrastructure aimed almost exclusively at Japan. Six AI-enabled attack servers were reported. Eight targeted companies publicly disclosed information leaks within about two months (September-October 2026). Named targets in press coverage include Daiwa Securities Group, East Japan Railway and SoftBank. Reported sectors: finance, insurance, logistics, retail, e-commerce, media, education, marketing, digital gifts and printing. One report cites Japanese attacks occurring between 2026-09-18 and 2026-10-18 and a broader analysis suggesting up to ~80 possible targets; this is not corroborated by the other fetched sources. GMO shared its findings with law enforcement.

ARTEX is open-source software first unveiled in July 2026 that connects to large language models so an agent performs reconnaissance, vulnerability research and verification largely autonomously. It was built for authorized security testing. GMO identified it through ARTEX configuration files and AI agent session histories left on attacker infrastructure. Reporting is inconsistent on whether ARTEX was confirmed on every one of the six servers; at least the initial infrastructure was confirmed.

The tool was previously documented by CrowdStrike (published 2026-10-07) in attacks on South Korean financial institutions (Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram Savings, Welcome Savings, Hyundai Capital), where an actor combined ARTEX with DeepSeek v4.1-flash (primary backend), GLM-5.3 and Grok 4.6, likely reached through the API proxy/reseller xcai.pro, and with Anthropic's Claude Code. Exposed open directories held Claude Code session histories, ARTEX configuration files, Claude memory files and a CLAUDE.md with a Chinese-language pentesting prompt. CrowdStrike listed an ARTEX host at 38.244.50.120, nine proxy IPs and a Hong Kong primary server, and noted the actor made basic operational-security mistakes. Targets there were auxiliary systems such as loan-inquiry services and employee mobile support systems with known vulnerabilities, missing MFA or patches, and lookup services lacking identity verification; at least 68,000 people's data was exposed.

Attribution is unresolved. GMO and secondary reporting caution that public evidence does not establish a single operator across all incidents or a link between the Japanese and Korean campaigns; GMO characterised the CrowdStrike comparison as context, not proof, and tool origin does not indicate operator nationality or state involvement. The Korean-campaign suspect was reported as a 26-year-old in Guangdong who denied involvement. After the misuse became public, the ARTEX developer announced the project would go closed-source with no further public releases and took down the GitHub page (announced Thursday, reported as around 2026-10-08), but previously released source and English/Korean-language derivatives remain usable. No malware hashes, CVEs or Japan-campaign IPs/domains were published.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX-Style LLM-Agent Web Reconnaissance Burst — Exploitation Phase** (`TL-2026-4723-SPL-001`)

Detects high-volume, high-diversity web requests with a high 4xx ratio from a single client in a 5-minute window, the footprint of an agentic AI pentest tool such as ARTEX driving automated reconnaissance and vulnerability verification against internet-facing applications (T1595.002 leading to T1190). Also matches the CrowdStrike-reported ARTEX host 38.244.50.120. Thresholds are behavioural and must be tuned per site; the IP is from the South Korean campaign and was not confirmed in the Japan campaign.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595.002, T1190
- **Data sources:** web_access_logs (index=web, sourcetype=access_combined), W3CIISLog
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=web sourcetype=access_combined earliest=-24h ```ARTEX-style LLM-agent recon (TL-2026-4723): many distinct paths with a high 4xx ratio from one client, or the CrowdStrike-reported ARTEX host 38.244.50.120```
| bin _time span=5m
| stats count AS requests dc(uri_path) AS distinct_paths count(eval(status>=400)) AS errors by _time clientip
| eval error_ratio=round(errors/requests,2)
| where (requests>=300 AND distinct_paths>=100 AND error_ratio>=0.3) OR clientip="38.244.50.120"
| table _time clientip requests distinct_paths errors error_ratio
````

### Microsoft KQL

```kql
// TL-2026-4723 ARTEX-style LLM-agent web reconnaissance burst
W3CIISLog
| where TimeGenerated > ago(24h)
| summarize requests = count(), distinct_paths = dcount(csUriStem), errors = countif(toint(scStatus) >= 400) by cIP, bin(TimeGenerated, 5m)
| extend error_ratio = round(todouble(errors) / requests, 2)
| where (requests >= 300 and distinct_paths >= 100 and error_ratio >= 0.3) or cIP == "38.244.50.120"
| project TimeGenerated, cIP, requests, distinct_paths, errors, error_ratio
```

### Sigma

```yaml
title: ARTEX-Style API Discovery Probing or Known ARTEX Host Access
id: 6f0d3a52-8c1e-4b7a-9d21-4e5a7c3b1a01
status: experimental
description: Detects web requests from the CrowdStrike-reported ARTEX host or requests for API documentation and schema endpoints, a common first step of agentic AI reconnaissance (TL-2026-4723). Behavioural volume thresholds are implemented in the SPL and KQL forms.
references:
  - https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
  - https://www.nippon.com/en/news/yjj2026102000795/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_ioc:
    c-ip: '38.244.50.120'
  selection_discovery:
    cs-uri-stem|endswith:
      - '/openapi.json'
      - '/swagger.json'
      - '/v2/api-docs'
      - '/v3/api-docs'
      - '/swagger-ui.html'
      - '/graphql'
  condition: 1 of selection_*
falsepositives:
  - Authorised vulnerability scanners and API developers
  - Legitimate API clients that fetch OpenAPI schemas
level: medium
```

**Known false positives:**

- Authorised vulnerability scanners and red-team engagements generating bursts of distinct paths
- Search-engine crawlers or uptime monitors behind shared NAT or CDN egress IPs

**Tuning notes:** Adjust the requests, distinct_paths and error_ratio thresholds to your baseline. Exclude approved scanner IPs and CDN or WAF egress ranges. If a reverse proxy fronts the site, use the X-Forwarded-For client field instead of clientip. Treat the 38.244.50.120 match as a high-priority lead regardless of thresholds, but note it is unconfirmed for the Japan campaign.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Automated Identifier Enumeration Against Lookup Services — Exploitation Phase (locked: unlock with TL Creds)
- ARTEX and Claude Code Agent Artifacts on Disk — Post-Exploitation Phase (locked: unlock with TL Creds)
- Server Egress to LLM API Providers or [indicator] Proxy — C2 and Proxy Phase (locked: unlock with TL Creds)
- Sensitive Configuration and Secret File Probing by Automated Scanner — Exploitation Phase (locked: unlock with TL Creds)
- Android and Flutter Reverse-Engineering Tools (jadx, Blutter) on Servers — Post-Exploitation Phase (locked: unlock with TL Creds)
- DNS Resolution of [indicator] LLM API Proxy — C2 and Proxy Phase (locked: unlock with TL Creds)
- ARTEX or Claude Code Agent Process Execution on Server — Post-Exploitation Phase (locked: unlock with TL Creds)
- Traffic To or From Reported ARTEX Host [indicator] — C2 and Proxy Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 16)

Defanged, TLP:CLEAR.

- IP address: `38.244.50[.]120`
- Domain: `xcai[.]pro`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Chinese AI Tool Likely Used in Cyberattacks on Japan Firms (Jiji Press / Nippon.com)](https://www.nippon.com/en/news/yjj2026102000795/)
- [Insurance Journal: Chinese AI tool ARTEX linked to attacks on Japanese companies](https://www.insurancejournal.com/news/international/2026/10/20/889658.htm)
- [ScanNetSecurity: GMO Cybersecurity by Ierae confirms AI autonomous pentest system ARTEX as attack source](https://scan.netsecurity.ne.jp/article/2026/10/21/56522.html)
- [ARTEX traces found on six servers in attacks targeting Japanese firms, GMO says](https://magica.com/news/gmo-cybersecurity-identifies-artex-use-in-attacks-targeting-japanese-companies)
- [GMO Cybersecurity Links China-Built AI Tool ARTEX to Japan Breaches](https://letsdatascience.com/news/gmo-cybersecurity-links-china-built-ai-tool-artex-to-japan-b-91cc98b1)
- [Security Measures Lab: GMO ARTEX AI attacks on Japanese companies](https://rocket-boys.co.jp/security-measures-lab/gmo-artex-ai-attacks-japanese-companies-20261019/)
- [eSecurity Planet: L'outil d'IA ARTEX lié à des cyberattaques contre des entreprises japonaises](https://www.esecurityplanet.com/fr/cybersecurity-threats/loutil-dia-artex-lie-a-des-cyberattaques-contre-des-entreprises-japonaises/)
- [CrowdStrike Details ARTEX Agentic AI Attacks on South Korean Banks](https://letsdatascience.com/news/crowdstrike-details-artex-agentic-ai-attacks-on-south-korean-af11b430)
- [BleepingComputer: Hacker used ARTEX AI and Claude agents to target South Korean banks](https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/)
- [Korea JoongAng Daily: Chinese AI tool linked to Korean bank hacks halts public updates as suspect denies involvement](https://www.koreajoongangdaily.com/business/chinese-ai-tool-linked-to-korean-bank-hacks-halts-public-updates-as-suspect-denies-involvement/12913376)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4723