What happened in Japan
According to the Japanese news agency Jiji Press, GMO Cybersecurity by Ierae, a subsidiary of the GMO internet group, traced attacks on Japanese companies to six servers, all of which used Artex, an AI-powered penetration testing tool (the tests experts run to find flaws before criminals do). The AFP news agency, cited by The Manila Times, reported that GMO said it had “confirmed” the use of Artex after investigating with outside organizations and that it shared its findings with the authorities.
According to Bloomberg, published by The Star, one attack infrastructure targeted about 20 Japanese companies, nine of them in the same sector, and the six additional servers attacked firms in e-commerce, finance, retail, logistics, media, education and marketing. Eight of the targeted companies disclosed data breaches between September and October. GMO said several incidents were the work of the same group, which appears to organize campaigns by country and by industry.
What Artex is and why it is worrying
Artex was presented as an autonomous security testing tool that uses language models, the same technology behind AI assistants, to probe systems, discover vulnerabilities and verify them. In other words, it automates much of the work that used to require an expert attacker with time on their hands.
This is not the first time it has appeared. According to the Japanese site Rocket Boys, the firm CrowdStrike had reported on October 7 Artex configuration files in attacks on financial institutions in South Korea, and described it as an open-source tool developed in China. According to AFP, the developer said using it to attack went against their intentions, cut off access to the source code because of the misuse and announced that the project will no longer be updated.
An important caveat: the tool's Chinese origin does not prove who the attackers are or that a state is behind them. Nor were all the “targeted” companies necessarily breached; GMO did not confirm the success of each attempt.
The context: a wave of attacks in Asia
Japan is going through difficult weeks in cybersecurity. AFP reports that dozens of Japanese companies, including restaurant chains and a car rental company, disclosed unauthorized access or breaches that could affect millions of customers, and that the government asked companies to strengthen their defenses. According to the same agency, in early October the head of the ruling party's cybersecurity committee declared a state of emergency in the face of the new threats.
The underlying lesson is that AI reduces the cost and time of attacking. A tool designed for defense, in the wrong hands, makes it possible to scan thousands of exposed systems looking for a single open door.
How to protect your company's systems, including communications
Based on GMO's recommendations reported by Rocket Boys, and also applied to telephony and customer service channels, these are concrete measures:
- Inventory everything exposed to the internet: websites, APIs, admin panels, legacy applications and also your IP PBX, your SIP trunks and access to your WhatsApp or call center platform. Every system should have an owner.
- Update, don't just block: a web application firewall (WAF) helps, but it doesn't replace applying patches. Also check for old or unsupported versions that share the same vulnerable code.
- Keep and review logs: web access, authentications and database queries. Look for repeated attempts, unusual access or mass data downloads. In telephony, watch for calls to unusual destinations or outside business hours, a typical sign of IP PBX fraud.
- Have a plan if something happens: close the entry point, determine which data was affected and check whether the incident reached contractors or suppliers.
- Protect credentials: strong passwords, two-factor authentication and least-privilege access to consoles and recordings.
What it means for businesses in Colombia and Latin America
Attackers using AI don't need to be in Japan to look for flaws in a server in Bogotá or Lima: the internet has no borders, and country-by-country campaigns can reach any market. For a Latin American company, this means cybersecurity is no longer just an IT issue but a management issue. Communications deserve special attention: a compromised phone system can generate huge bills from fraudulent calls, and a leaked customer database opens the door to phone, SMS or WhatsApp scams in your brand's name.
The good news is that the basic measures (inventory, updates, monitoring and encryption) are still the most effective. At 19 80 TIC Cloud we help you review how your cloud telephony and your encrypted calls are protected to reduce these risks.
