Tia N.List

Reported by 4 outlets

ARTEX AI, Claude agents used in cyberattacks on South Korean banks

new2.1
Why this score
Breadth
2.00 / 2.0 · 4 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
0.70 / 5.0 · CVSS + content signals
Velocity
0.50 / 2.0 · updates in 48h
Pickup speed
0.46 / 0.6 · time to second source
Recency
× 0.39 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
2.1 / 10 = base × recency + community
bleepingcomputer.comcrowdstrike.comthehackernews.comsecurityaffairs.com desk first seen 3d ago

Desk analysis

A Chinese-speaking actor used the open-source ARTEX AI penetration-testing suite together with Claude agents to target South Korean banks in late September through early October 2026. CrowdStrike identified open directories at a Hong Kong IP containing Claude Code session histories, Claude memory files, and ARTEX configuration files. The attacker used DeepSeek v4.1-flash as the primary LLM backend, supplemented by GLM-5.3 and Grok 4.6.

Targeted institutions include Shinhan Bank, KB Kookmin Bank, and Hana Bank, with reports of exposed personal data, credit card information, and system outages. The South Korean government called an emergency meeting. Because the same AI setup was used to draft a resume, the actor exposed identification, contact details, and a Telegram account (@YY520CN), which a linked message later denied responsibility.

This is a real, verified campaign with primary attribution from CrowdStrike and coverage by The Hacker News, SecurityAffairs, and BleepingComputer. It demonstrates agentic AI tools being reused for both offense and operational security failures.

Timeline

  1. original reporting

    ARTEX AI, Claude agents used in cyberattacks on South Korean banks

    bleepingcomputer.com · 3d ago · October 10th, 2026

    A Chinese-speaking hacker launched cyberattacks that shook the South Korean financial sector earlier this month, using the ARTEX AI penetration testing suite and Claude agents. The actor targeted multiple Korean banks , including Shinhan Bank, KB Kookmin Bank, and Hana Bank, exposing clients ' personal data and credit card information, and causing system outages in some cases. The South Korean government reacted with an emergency meeting and calls for immediate security measures for critical IT systems. Security firm CrowdStrike confirmed the use of ARTEX AI, up until recently an open-source agentic penetration testing suite developed in China. Researchers identified the attacker's infrastructure and found open directories with Claude Code session histories, ARTEX configuration files, and Claude memory files. “The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained. “The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” the researchers noted . These records also provided insight into the attacker’s activities, with targets overlapping those named in previous reporting about financial-sector breaches, allowing for high-confidence linking. Because the threat actor used the same AI tools to create a résumé, they also exposed identification, contact, and Telegram account details. Based on

  2. update from crowdstrike.com

    Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

    crowdstrike.com · 5d ago · October 8th, 2026

    CrowdStrike Intelligence published a disclosure on October 8, 2026 identifying open directories at a Hong Kong-based IP containing Claude Code session histories, Claude memory files, and ARTEX configuration files. The campaign was active from late September to early October 2026 and targeted South Korean financial organizations, with exfiltrated data from Shinhan Bank and other institutions.

  3. update from thehackernews.com

    ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

    thehackernews.com · 5d ago · October 8th, 2026

    A Telegram message from the suspected actor (@YY520CN) posted the same day denied responsibility.

  4. mentioned by www.bleepingcomputer.com

    🤖 Chinese-speaking actor used the ARTEX AI pentest suite + Claude agents (DeepSeek v4.1-flash, GLM-5.3, Grok 4.6 backends) to target Shinhan

    www.bleepingcomputer.com · 3d ago · October 10th, 2026

  5. update from thehackernews.com

    🤖 CrowdStrike: ARTEX, a Chinese open-source agentic pentest tool, was used with Claude Code to breach South Korean financial firms (Shinhan

    thehackernews.com · 3d ago · October 11th, 2026

    🤖 CrowdStrike: ARTEX, a Chinese open-source agentic pentest tool, was used with Claude Code to breach South Korean financial firms (Shinhan

    via Mastodon https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html

  6. update from securityaffairs.com

    🤖 CrowdStrike: a single operator used ARTEX, an open-source Chinese agentic pentest tool, plus LLMs, to hit South Korean banks (late Sept–ea

    securityaffairs.com · 2d ago · October 11th, 2026

    🤖 CrowdStrike: a single operator used ARTEX, an open-source Chinese agentic pentest tool, plus LLMs, to hit South Korean banks (late Sept–ea

    via Mastodon https://securityaffairs.com/200661/hacking/ai-driven-tool-artex-used-in-attacks-against-south-korean-banks.html

  7. update from www.bleepingcomputer.com

    Whoever breached South Korean banks in late September used the same AI setup to draft a CV. CrowdStrike found the session histories in an op

    www.bleepingcomputer.com · 2d ago · October 11th, 2026

    Whoever breached South Korean banks in late September used the same AI setup to draft a CV.

  8. mentioned by www.bleepingcomputer.com

    # ARTEX # AI , # Claude agents used in cyberattacks on South Korean banks https://www. bleepingcomputer.com/news/secu rity/hacker-used-artex

    www.bleepingcomputer.com · 1d ago · October 12th, 2026

Covered in

digest 2026-10-11

Source on GitHub