Last week’s misstep by a hacker group has pulled back the curtain on a coordinated campaign targeting financial institutions in South Korea — and exposed the AI tools behind it.
What Happened
Between late September and early October 2026, seven South Korean banks suffered breaches via internet-facing systems. Attackers accessed sensitive personal and financial records belonging to approximately 66,000–67,000 individuals and some 2,200 companies, including names, employment status, income, and loan data.
Analysis by cybersecurity firm CrowdStrike attributed the incident to an ARTEX deployment — ARTEX is an open-source AI-based penetration testing framework developed in China. Rather than a traditional hacking collective, the breach appears to have been carried out by a single financially motivated individual fluent in Chinese.
Technical Exposé
The culprit’s infrastructure was unintentionally revealed when servers were left publicly accessible. Key findings include an ARTEX GitHub page and Docker image, which were taken down on October 11. Still, mirrored copies of the code remained online.
A particularly noteworthy discovery came from a Hong Kong-based jump host that contained a state file showing use of Claude Code version 2.1.221, launched over 510 times since early August 2026. Interestingly, direct communication with Anthropic was not detected.
The attacker funneled requests through a domain reseller (xcai.pro) to services like DeepSeek. Evidence also pointed to Zhipu AI’s GLM models and a tunnel named grok2api. A number of helper scripts bore Chinese comments that detailed part of the routing setup.
Attached to the infrastructure were 19 reusable “skills,” or instruction bundles, covering reconnaissance, code review, web testing, and cloud phone control, among others. One module seems tailored to probe for insecure direct object reference flaws — vulnerabilities that enable attackers to access or manipulate someone else’s data.
Hidden in the repository was a “.secrets” file containing root login credentials, along with setup for keeping reverse SSH tunnels alive and continuously copying AI state data to the jump server.
Extent, Risks, and Mitigation
Tools and scripts found reached beyond the immediate banking hack. Instances included proxy services with dozens of exit IPs, setups for remote code execution via JNDI and LDAP, crypto exchange integrations, privilege escalation exploits, and tooling for iOS and Android platforms. Whether all these components were used in the bank breaches is not confirmed.
Hunt.io identified over 1,300 additional ARTEX-linked resources through certificate searches, malware tags, and title-based filtering — spanning countries led by the U.S., China, and Hong Kong. Dozens of open directories with exposed files showed the framework has likely been adopted in multiple attacks.
Authorities recommend closing public access to administrative services, employing VPNs or allowlists, rotating SSH credentials and API keys, and scrutinizing outbound connections like LDAP and DNS lookups. Locking down gateways to AI models is also urged. In a related development, South Korean law enforcement arrested a suspect in a case linked to ARTEX — though there’s no confirmed overlap with this breach.
Indicators of Compromise (IoCs)
- 38.244.50[.]120 – ARTEX console host and SSH tunnel endpoint
- 23.248.226[.]250 – Jump host in Hong Kong with exposed tooling directories
- 154.201.79[.]246 – Proxy service used in exploitation scripts
- xcai[.]pro – AI reseller domain tied to workflow
- fofoapi[.]com – Third-party API used in FOFA client
- u6ud2s[.]dnslog[.]cn – DNS callback server used in exploit setup
- 38.244.50.120:8000; 23.248.226.250:18099 & :8001 – Open directories with various attack tools
- C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842 – TLS certificate fingerprint tied to the ARTEX console
- HTTP page title “ARTEX – 自主渗透测试控制台” – used in threat-intel queries for detection
This theft demonstrates how AI-centric attack tools are now integrated deeply into hacker modus operandi. The blend of autonomous agents, proxy hopping, and multiple AI models shows a growing complexity that is difficult to counter with traditional defenses alone.
Analysis: This breach marks a troubling evolution in adversarial capabilities — AI agents (like Claude Code, DeepSeek, GLM, Grok) are being stitched together into pipelines by lone operators. It underscores the urgency for financial institutions to assume that any publicly exposed service is a risk. The perimeter has blurred: often it’s not just code or credentials, but model access and embedded AI process flows that need protection. Going forward, threat intel needs to extend beyond malware hashes and vulnerability scans to include auditing AI model use, API gateways, and operationalizing AI governance in security programs.
