ARTEX AI: The Pentest Tool That Hit Korean Banks

ARTEX AI: The Pentest Tool That Hit Korean Banks

In the last days of September 2026, someone pointed an open-source penetration-testing agent at South Korea's biggest banks and let it run. By the time the alerts were triaged, personal data belonging to roughly 68,000 people had leaked from at least seven financial firms (The Record). South Korea's National Police Agency opened a cyber-terror investigation, the government called an emergency meeting, and a security tool called ARTEX became the centre of the first widely reported case of an LLM-driven agent being used to break into a national financial sector.

This is not "the AI went rogue." It is more mundane, and more useful to understand: an agentic tool collapsed the skill and time it takes to run a broad, automated intrusion.

What Actually Happened

Reporting from Korea's Financial Security Institute (FSI) and the security firm CrowdStrike describes a campaign that ran from roughly 27 September to 1 October, against internal and partner-facing systems — not the hardened internet and mobile banking apps.

The confirmed losses, per Korean regulators and the FSI (Herald Business, GovInfoSecurity):

• Shinhan Bank — 25,729 customers via a loan-progress inquiry service used by brokers, including names, phone numbers, annual income and credit details.
• Yegaram Savings Bank — around 40,000 customers.
• Welcome Savings Bank — about 2,200 corporate records.
• KB Kookmin Bank — 119 records from an employee mobile work-support system.
• Hana Bank — 89 records from an employee sales-support system known as ODS.
• BNK Busan Bank — information on 11 contract workers.

Investigators reportedly found 33 attack IP addresses spread across eight countries, including Korea, the US, Japan and Hong Kong (Kyunghyang Shinmun). CrowdStrike cautions that the total number of affected organisations "remains unconfirmed."

South Korean President Lee Jae Myung put the implication bluntly: "Signs have emerged" that AI agents were deployed in at least some attacks, and "it's now become possible to use AI to hack with ease even without specialized skills" (The Record).

The Tool: ARTEX

ARTEX is an LLM-based autonomous penetration-testing system, published on GitHub in late July 2026 by a developer using the handle Autumn-27 (reported as a Chinese security engineer, Li Puhua) (GovInfoSecurity). It is not obscure: on 3 September it placed first among some 150 teams at an attack-and-defence competition hosted by Baidu. Its latest version shipped on 24 September; the attacks on KB Kookmin began around 27 September (Kyunghyang Shinmun).

CrowdStrike reconstructed the operator's stack from leaked session files. The ARTEX instance ran DeepSeek v4.1-flash as its primary model, supplemented by GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions, with DeepSeek apparently reached through an API reseller, xcai[.]pro (CrowdStrike). The tool's web console advertises itself with an HTML title that reads, in Chinese, "ARTEX — autonomous penetration test console."

That title is the single most useful thing in the whole story: it is a detection signature. Investigators spotted it on a command-and-control server before they had any other clue.

The mechanism of the Shinhan breach is a reminder that "AI attack" often just means "the boring thing, but faster." The attacker fed random values into a loan-broker inquiry endpoint to find valid customer numbers, then pulled the associated records — an automated brute-force sweep, not a clever zero-day (Kyunghyang Shinmun). CrowdStrike assesses the operator was likely a Chinese speaker and financially motivated, with moderate confidence — not attribution to a named group.

The Attacker Doxxed Themselves

Here is where the automation cut the other way. The operator left open directories on two servers — a primary host and the ARTEX box — exposed to the public internet. Those directories contained Claude Code session histories, ARTEX configuration files and Claude memory files (CrowdStrike).

The sessions showed the operator using Claude not only to run tooling but to write a security-researcher résumé — complete with a name, phone number, Telegram handle @YY520CN, age, university and city. CrowdStrike is careful: those details likely belong to the individual behind the activity, but are "not reliable enough to confirm the threat actor's identity." The FSI likewise told reporters that a China-developed tool alone is insufficient to conclude the attacker's nationality, and that IP-based attribution is close to useless when the traffic hops eight countries.

This is the agentic-ops version of a familiar failure. The same LLM sessions that made the intrusion efficient also logged the operator's intent, their targets, and their résumé — and then served it over plain HTTP. If you build or run agent tooling, that session history is evidence, and it lives on the same host you are using to attack with. See our earlier write-up on the OpenAI/Hugging Face sandbox escape for how quickly agent artifacts become forensic gold.

Hunting for ARTEX

You will rarely see ARTEX on your perimeter. You will see its behaviour: a rotating pool of proxy IPs hammering one internal endpoint with a high volume of distinct parameter values. The one hard indicator we have is the console title string. A small triage script over your access logs can surface both:

#!/usr/bin/env python3
"""Triage access logs for ARTEX-style agentic pentest activity.

Two heuristics:
  1. C2 marker   - the ARTEX web console ships an HTML <title> containing
                   "ARTEX" and "自主渗透测试控制台" (autonomous pentest console).
  2. Enumeration - a high volume of distinct parameter values aimed at one
                   internal inquiry endpoint (brute-forcing valid customer
                   numbers), typically across rotating proxy addresses.

Input: TSV lines "ip<TAB>path<TAB>query<TAB>status<TAB>title", one per request.
"""
import sys
from collections import defaultdict

ARTEX_MARKERS = ("ARTEX", "\u81ea\u4e3b\u6e17\u900f\u6d4b\u8bd5\u63a7\u5236\u53f0")
ENUM_MIN_DISTINCT = 50
ENUM_HINTS = ("loan", "inquiry", "ods", "work-support", "broker")


def triage(lines):
    markers = []
    queries_by_path, ips_by_path = defaultdict(set), defaultdict(set)
    for n, line in enumerate(lines, 1):
        parts = line.rstrip("\n").split("\t")
        if len(parts) < 5:
            continue
        ip, path, query, status, title = parts[:5]
        if any(m in title for m in ARTEX_MARKERS):
            markers.append((n, ip, path, title[:60]))
        if any(h in path.lower() for h in ENUM_HINTS):
            queries_by_path[path].add(query)
            ips_by_path[path].add(ip)

    print("== ARTEX console markers ==")
    for n, ip, path, title in markers:
        print(f"  line {n}: {ip} {path} title={title!r}")

    print("== Enumeration bursts ==")
    flagged = [(p, len(q), len(ips_by_path[p])) for p, q in queries_by_path.items()
               if len(q) >= ENUM_MIN_DISTINCT]
    for path, distinct, sources in sorted(flagged, key=lambda x: -x[1]):
        print(f"  {path}: {distinct} distinct values from {sources} source IPs")
    if not markers and not flagged:
        print("  nothing flagged")


def main():
    try:
        with open(sys.argv[1], encoding="utf-8") as fh:
            triage(fh)
    except IndexError:
        print("usage: artex_triage.py access_log.tsv", file=sys.stderr)
        sys.exit(2)
    except FileNotFoundError:
        print(f"no such file: {sys.argv[1]}", file=sys.stderr)
        sys.exit(2)


if __name__ == "__main__":
    main()

The two signals map to CrowdStrike's own ATT&CK mapping for this campaign: T1588.007 (Obtain Capabilities: Artificial Intelligence) for pulling in ARTEX, and T1090 (Proxy) for the rotating infrastructure. Neither is exotic — which is exactly the point. This campaign did not need a novel technique. It needed volume.

What Developers and Defenders Should Take From It

Your customer-facing perimeter is not the target. Every confirmed breach here ran through an internal employee or partner-facing system — a broker inquiry service, a mobile work-support tool, a sales ODS. Those are frequently the systems with the thinnest authentication, because they were never treated as crown jewels. Inventory them like you inventory the internet-facing ones.

IP-based controls are already weaker. Thirty-three addresses across eight countries, plus nine proxy IPs named by CrowdStrike alone. An IP allowlist on an internal tool stops a bored attacker and does nothing against a proxy pool. Rate-limit and profile behaviour per endpoint instead.

Agentic tools are dual-use by default. ARTEX was built as a red-team assessment tool and published openly; within weeks, it was repurposed against live banks, and its author then made the project closed-source and stopped updating it (BleepingComputer). Derivatives already exist. The lesson for anyone shipping an autonomous security agent is the one in our agent threat-model piece: the capability is the boundary, and open capability moves fast.

Session logs are evidence — treat them that way. The attacker's own Claude Code history is what let CrowdStrike reconstruct the entire operation. If you run agents in production, your prompt and memory files may be the most sensitive data on the box. Encrypt them, expire them, and never expose the directory that holds them.

One honest caveat runs through all of this: Korean officials stress that the AI did not act independently — "a hacker used the AI as a tool." The novelty is not autonomy. It is leverage. A single operator, some rented GPUs and an open-source agent now produce the breadth of a small intrusion team, and the phishing-style skill curve that used to filter out noise is gone.

Sources

• CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
• BleepingComputer: ARTEX AI, Claude agents used in cyberattacks on South Korean banks
• The Record: South Korean officials believe AI agents were used to hack several banks
• GovInfoSecurity: South Korea Suspects AI Tool Helped Steal Bank Customer Data
• The Kyunghyang Shinmun: Korean finance breached by a two-month-old Chinese AI
• The Herald Business: Exclusive: Chinese AI tool ARTEX used in wave of bank hacks, probe finds
• The Wall Street Journal: Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk