AI Tool That Hacked Korean Banks Was Used in Japan: Security Firm

The hackers who recently infiltrated some of Japan’s biggest companies used an AI tool developed in China and linked to a rash of breaches at South Korean banks last month, according to a Tokyo-based internet security firm.

Researchers confirmed that ARTEX, developed in China to test cyberdefenses, was used in many of the recent attacks in Japan, said Daiki Fukumori, director of cybercrime countermeasures center at GMO Cybersecurity by Ierae Inc.

The attacks were launched from a single server infrastructure aimed almost exclusively at Japan, he wrote in a blog post. Targets included about 20 Japanese companies, including nine in the same industry, he said.

The findings shed new light on a wave of data breaches that have plagued companies across Japan, from Daiwa Securities Group Inc. to East Japan Railway Co. and SoftBank Corp. The attacks prompted calls by government officials to step up cybersecurity. Japan is home to a diverse group of linchpins in the global tech and industrial supply chains.

The cybersecurity unit of GMO Internet Group Inc. also identified six AI-enabled servers that appeared to target Japanese companies across sectors such as e-commerce, finance, retail, logistics, media, education and marketing. Eight of the targeted companies have disclosed data leaks in the last two months, and the same group may be behind multiple breaches, said Fukumori, a former Interpol investigator. The attackers appear to be running country- and industry-specific campaigns, he said.

Ierae, which houses a team of white-hat hackers, has shared its findings with law enforcement and is investigating whether countries beyond Japan and South Korea are also being targeted, Fukumori said.