The hackers who have carried out a number of attacks on Japanese organisations in recent weeks used the same Chinese-developed AI security tool that was also used to attack South Korean financial institutions, Tokyo-based researchers said.

ARTEX, a semi-autonomous, AI-powered penetration testing tool developed in China, was used in many of the recent attacks in Japan, said Daiki Fukumori, director of the cybercrime countermeasures centre at GMO Cybersecurity in an advisory.

Around 80 companies in Japan across various industries have been hit by attacks in recent weeks, with some reporting unauthorised access leading to data breaches or potential data breaches.

China-linked incidents

The affected companies include Daiwa Securities, East Japan Railway and SoftBank.

CrowdStrike previously found that ARTEX was used in the South Korean attacks.

GMO said it uncovered what it said were six AI-based attack infrastructures that were each set up to target a specific sector in Japan, including finance, e-commerce, logistics, media, education and marketing.

The company found that around 20 groups were targeted by the attack units, with nine in the same industry.

Eight of the targeted companies have disclosed data leaks in the past two months, said Fukumori, a former Interpol investigator.

Speaking at a press conference on Tuesday, Japan’s cybersecurity minister Toshiharu Furukawa said the government had heard from companies that sustained damage from cyber-attacks and was analysing whether AI was involved.

“We will investigate actors behind attacks and the source of attacks by taking into account all possible scenarios, including the involvement of foreign actors,” said chief cabinet secretary Minoru Kihara at a separate press conference later on Tuesday, the Kyodo news agency reported.