ARTEX AI and Claude Agents Used in South Korean Bank Attacks
A Chinese-speaking hacker utilized the ARTEX AI penetration testing suite and Claude agents to launch disruptive cyberattacks against the South Korean financial sector.
Radwan AbdulhadiEditor and technology writer
Cyberattacks Target South Korean Financial Sector
Earlier this month, a Chinese-speaking hacker launched cyberattacks that shook the South Korean financial sector using advanced artificial intelligence tools. The actor targeted multiple Korean banks , including major institutions like Shinhan Bank, KB Kookmin Bank, and Hana Bank.
These security breaches exposed clients' personal data and credit card information, while also causing system outages in certain cases. In response to the crisis, the South Korean government reacted quickly by holding an emergency meeting and calling for immediate security measures across critical IT systems.
CrowdStrike Confirms ARTEX AI and Claude Usage
Security firm CrowdStrike confirmed the use of ARTEX AI, which up until recently operated as an open-source agentic penetration testing suite developed in China. According to details shared by researchers noted in investigative reports, the attacker's infrastructure left open directories exposed.
These open directories contained Claude Code session histories, ARTEX configuration files, and Claude memory files. Investigators were able to piece together the exact tools and language models deployed during the operation.
Multi-Model LLM Backend Configuration
The operational setup behind the attacks leveraged several prominent artificial intelligence models. CrowdStrike explained that the ARTEX instance used DeepSeek v4.1-flash as the primary large language model backend.
Furthermore, the threat actor supplemented this primary LLM with GLM-5.3 from Zhipu AI and Grok 4.6 to power additional Claude Code sessions. Researchers noted that the threat actor likely accessed DeepSeek through an LLM API proxy or reseller service known as xcai[.]pro.
Attacker Profile and Exposure of Personal Data
Because the threat actor utilized the same artificial intelligence tools to create a résumé, they inadvertently exposed their own identification, contact details, and Telegram account information. Based on the information contained within this résumé, CrowdStrike suggested that the attacker may be a 26-year-old Chinese individual who studied at the South China University of Technology and currently resides in Maoming, Guangdong, China.
However, investigators also found that the attacker initially provided a conflicting date of birth pointing to 2007. Although these personal details may indeed belong to the individual behind the ARTEX-related activity, researchers emphasized that the information is not reliable enough to definitively confirm the threat actor’s true identity.
Lack of Monetization Plan and Subsequent Project Changes
Analysis of the recovered records indicated that the attacker had no specific pre-arranged plan regarding how to monetize the data stolen from South Korean banks. Logs show the actor explicitly asked Claude to propose Telegram data-sales groups specifically focused on Korea.
Following confirmation that ARTEX had been actively weaponized in real-world attacks, the developer decided to make the project closed-source and discontinue further public updates. Despite this shift, the project’s existing code has already been utilized to generate English- and Korean-language derivatives , meaning portions of the tool remain accessible in their current form.
Sources
- BleepingComputerARTEX AI, Claude agents used in cyberattacks on South Korean banks
Continue chronologically
Related entity coverage
Related stories
Chinese Hackers Use ARTEX AI in Attacks on 200 Orgs
Chinese hackers leveraged the open-source ARTEX AI penetration-testing framework in automated global attacks targeting over 200 organizations.
CrowdStrike Acquires Fiddler and Dreadnode for $495 Million
CrowdStrike announced agreements to acquire AI observability firm Fiddler and security testing startup Dreadnode in deals reportedly worth $495 million.
South Korea Probes AI-Linked Bank Breaches and Other Cyber Threats
SecurityWeek's latest roundup covers AI-linked bank hacks in South Korea, a poem-guided botnet, the Empire Market sentencing, and GPU monitoring leaks.
Chinese Hackers Exploited Low-Severity ESXi Logging Flaw as Zero-Day
CISA warns that China-nexus threat actor Warp Panda exploited a low-severity VMware ESXi logging flaw, tracked as CVE-2026-41709, as a zero-day.
