Chinese AI Hacking Tool Suspected in Attacks on Both Korean Banks and Japanese Firms

The use of ARTEX in cyberattacks on Japanese and Korean financial institutions highlights how dual-use AI tools, designed for legitimate security testing, can be repurposed for malicious activities. ARTEX, originally an open-source penetration-testing program, allows an AI agent to analyze targets and map intrusion routes by linking multiple large language models like GPT and Claude. Its open-source nature meant that while intended for defensive security audits, its code could be downloaded, modified, and exploited by unauthorized actors.

The analysis by GMO Internet Group's information security subsidiary identified traces of ARTEX on six overseas public servers used in attacks on Japanese businesses between September 18 and October 18. This finding, combined with U.S. security firm CrowdStrike's report on its use in Korean financial attacks, suggests a consistent pattern of deployment. The absence of other AI agents on the analyzed servers led the firm to conclude ARTEX was the likely tool.

The developer's decision to take ARTEX private and its subsequent re-emergence as a paid, commercial service under Threatbook, named RedAgent.ai, reflects an attempt to control its distribution and monetize its capabilities. This shift from an open-source project to a managed platform, including ARTEX Pro and other AI penetration-testing tools, indicates a market response to the security implications of such powerful AI agents. This commercialization might introduce more oversight, but it also signals the growing availability of advanced AI-driven security tools, for both defensive and potentially offensive uses, within a controlled ecosystem.