ARTEX AI and Claude agents used in attacks on South Korean banks

A Chinese-speaking threat actor used the ARTEX AI penetration testing suite and Claude agents in cyberattacks targeting South Korean banks, according to reporting by BleepingComputer. CrowdStrike confirmed the use of ARTEX AI.

The targets included Shinhan Bank, KB Kookmin Bank and Hana Bank. The attacks exposed customers’ personal data and credit card information and caused outages in some cases. South Korea’s government held an emergency meeting and called for immediate security measures for critical IT systems.

Researchers found open directories containing Claude Code session histories, ARTEX configuration files and Claude memory files. CrowdStrike said the ARTEX instance used DeepSeek v4.1-flash as its primary large language model backend, with GLM-5.3 from Zhipu AI and Grok 4.6 used in additional Claude Code sessions. Researchers said the actor likely accessed DeepSeek through an LLM API proxy or reseller.

The records also exposed résumé and account details that may relate to the actor, but researchers said they were not reliable enough to confirm the person’s identity. CrowdStrike reported that the records showed no specific plan to monetize the stolen bank data.

After confirming ARTEX had been used in real-world attacks, its developer decided to make the project closed-source and stop further updates. The current code has also been used to create English- and Korean-language derivatives.