AI Infiltration Framework ARTEX Breaking Korea Bank: A Full Chain Reset

Between late September and early October 2026, several Korean financial institutions were exposed to data leaks. It's not the size of the leak itself, it's the set of “crime kits” left by the attackers: an open source AI penetration framework called ARTEX, plus a combination of Claude Code, DeepSeek, GLM, Grok. CrowdStrike almost completely restored the entire operation through an open catalogue on the attackers ' own servers. This is a full-link break-up based on public information.

Summary of events

According to CrowdStrike ' s report of 7 October 2026, an attacker who has not yet been named as the cause launched a targeted attack against Korean financial organizations in late September to early October 2026 and successfully leaked data. The attackers were assessed as “Chinese users, economic motives” and as having medium confidence - I don't know. Based on the Chinese development background of the tool ARTEX and the Chinese hint observed in the session.

It should be noted that the link between ARTEX and the invasion is based mainly on the attackers ' own logs, which have not yet been independently confirmed by the injured agency or Korean official. The number of institutions affected by the different media is also not uniform (5, 7, 9 etc.), so the data on victimization are provisional.

What's ARTEX?

ARTEX is an open-source penetration testing system based on a multi-intelligence structure. According to its description, it "uses multiple agents to automatically complete information collection, gap detection, attack routing, security tools to call and leak validation". It is not the model itself, but is responsible for organizing calls to large external models and security tools.

It was launched on 26 July 2026 with AGPL-3.0 permission, under the signature of Automán-27. After the event became known, on October 8, the developer removed the project from GitHub, stating that it was no longer updated and closed due to abuse. However, a copy of the distribution — a Korean fork has reportedly appeared — cannot be retrieved from the shelf.

III. Dismantling the entire chain: how did an attack get up?

CrowdStrike obtained ClaudeCode session history, ARTEX configuration file and Claude memory file from the attacker-controlled server open directory, thus restoring the tool chain and operating technique:

• Double server structureOne IP, located in Hong Kong, as the main infrastructure, and another IP (38.24.50.120) carries examples of actual attacks on Korean targets.
• Model division of labour: ARTEX uses DeepSeek v4.1-flash as the main reasoning backend, and uses the brain spectrum GLM-5.3 and xAI 's Grok 4.6 to support additional Claude Code sessions. DeepSeek is suspected to have been visited by an API agent/seller xcai.pro.
• Proxy Jumper: About 9 proxy IPs are used for traffic transit, forming C2 and infrastructure layers together with the master/examples server.
• Claude's Role: Not just technical assistance. The log shows that the operator also asked Claude to help find the Korean language group that could sell the leaked data in Korea and to write a “Security Researcher’s CV” to write the results of the invasion into CV entries.

Four, how did the foot come out?

The key to this exposure is that the attackers left their infrastructure in an “open catalogue”. CrowdStrike read directly at .claude/CLAUDE.md on the 188999 port of IP 38.24.50.120 — a Chinese-language penetration test warning document that sets out how LLM should operate. Suzudo found more open directories on the Hong Kong IP, which contain full session history, ARTEX configuration and Claude memory files.

In other words, the technical content of the attack chain does not match its operational hygiene levels: while driving an automated attack using a front-line large model, key logs and configurations are attached to a publicly accessible catalogue.

Attribution and confidence: the need for caution

CrowdStrike did not attribute his activities to a well-known opponent, but gave a “Chinese user, economic motivation, medium confidence” judgement. The personal information leaked in the sessions (name YY, telephone, Telegram account @YY520CN, China Polytechnic University, Maumin Guangdong, etc.) appeared in the report, but the report itself suggests that it is not possible to confirm that the information is currently the perpetrator himself. The Register also pointed out that age information was inconsistent. The Korean police are still assessing whether the act was committed by one person or by a group.

Personal identity information should be confirmed by law enforcement authorities and should not be directly disseminated as a finding.

VI. VICTIMS AND DISTRIBUTION OF DATA

Access was reported to be two very “conventional” types of systems: a loan progress query service for financial brokers and a mobile office support system for staff. Common features of these systems are: Internet-oriented, built for convenience, and often not within the reinforcement of the core banking system.

Media named institutions include Shinhan Bank (approximately 25,000 clients), KB Kokmin Bank (119 people), Hana Bank (small sales support system), Yegaram Savings Bank (approximately 40,000 people), and 5 others, 7 and 9 of various calibres, with a total of about 68,000 personal data exposed. The leaked fields include names, contact details, resident registration numbers, annual income and loan lines - information that is well suited for use in precision social workers and subsequent fraud.

Why should the defense be nervous?

Two points need to be highlighted. First, the finding of ARTEX marks on the server does not in itself prove that ARTEX completed the invasion; the report also mentions that the same can be said of the charges against the credential stuffing and the attack on the less protected staff entrance. Second, the involvement of ARTEX was not publicly acknowledged by banks and authorities at the time of the incident.

But what is more alarming is the tool properties: ARTEX is a “dual-use” authorization test tool whose functions overlap highly with those of the attackers — detection, detection of loopholes, use of selection, validation. Open source publication means that no vendor is allowed to enforce acceptable use terms, no customer review and no cancellation of access. The contrivance of the developers explains precisely the limits of such control: fork, mirror, and local cloning almost inevitably.

Add a little more: Model providers can detect and interrupt abuse of their own services, but the operator spreads the work to multiple suppliers. Banks should not place defences on the assumption that “model manufacturers' fences will stop upstream”.

VIII. DELIBERATION RECOMMENDATIONS

• Let's see what's out there.: This portal is an ordinary Web service, rather than a non-core system. Update the list of offline assets to cover the customer query portal and move back-ends to staff and immediately exit or tighten systems that are not clearly attributed.
• Reinforce authentication: Confirm that the certification of these services carries the documentation to fill.
• Access to threat intelligence indicatorsOther Organiser
• Identification of automated behavioural characteristics: HF systematic detection from a small number of sources, rapid iteratives of response to errors, attempts at rapid inter-target change — aligning WAF with robotic management rules.
• Use the same tools for authorized self-measurement.• Quantified detection coverage through testing of its own exposure services using ARTEX-type tools in segregated environments and written rules of engagement; and avoiding unverified fork only with locally constructed reviews.
• Field level data protection(b) Resident registration numbers, income, loan lines, etc. should be minimized, tokenized or field-level encrypted, so that the damage is even smaller when the peripheral system is breached.

In the longer term, boards of directors and risk departments need to be planned according to a threat model that “reconnaissance and one phase uses to become cheaper and sustainable”. Controls that relied on the cost of the attackers in the past — such as cold-door services without detection and slow patches of low-priority systems — needed to be reassessed. At the same time, dual-use items under the shelf do not really capture them and should be tracked continuously through threat intelligence fork and subsequent versions, rather than waiting for a tool to be named.

When the cost of reconnaissance and the first round of utilization is pushed close to zero, the age of living by "no one will notice my system" is over.