Reported by 9 outlets
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.47 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
CrowdStrike Intelligence attributes a data-theft campaign against seven South Korean financial institutions, including Shinhan Bank, KB Kookmin and Hana Bank, to an unknown threat actor operating ARTEX, an open source autonomous penetration testing tool published on GitHub by user Autumn-27. The activity ran from late September into early October 2026, and the Financial Security Institute confirmed the ARTEX link on October 5 after tracing attack IP addresses and server logs from Shinhan, the first bank to report. The forensic anchor is the control-console string ARTEX-自主渗透测试控制台 left in the HTML title of a server used in the campaign. CrowdStrike's discovery path ran through the actor's own operational security failures: open directories exposing Claude Code session histories, ARTEX configuration files and Claude memory files, which show DeepSeek v4.1-flash as the primary model with GLM-5.3 and Grok 4.6 in supporting roles.
The confirmed haul is 65,000 to 68,000 people. Shinhan alone lost data on about 25,000 customers, including 66 cases containing resident registration numbers, while KB Kookmin reported 119 and Hana 89, and the fields taken, names, phone numbers, annual income and loan eligibility limits, are identity-theft-grade and stay monetizable for years. The exploit story is deliberately mundane: Shinhan disclosed an authentication bypass on a loan-facing web service, no CVE attached, and Yonhap's sources judged the bank was caught in random AI-powered attacks against vulnerable platforms rather than targeted by name. The point the event list does not make on its own is what that combination means: ARTEX collapses the per-target operator labor that used to protect weak portals, so the binding constraint moves from attacker skill to the number of half-secured partner portals in existence, and the up-to-43-hours-undetected dwell TechTimes reported shows the margin. Any lender running loan-broker or outsourced-developer portals is in scope whether or not anyone has heard of it.
There is no vendor patch; the fix class is the one Shinhan disclosed on October 1, authentication hardening and abuse controls on partner-facing loan services. Hunt for the artifacts that caught this campaign: sweep internet-facing web servers for ARTEX-自主渗透测试控制台 in page titles, and check web roots and exposed directories for Claude Code session histories, CLAUDE.md pentest prompts, ARTEX configuration files and Claude memory files, the exact classes CrowdStrike used, whose entry directory sat on 38.244.50[.]120:18899. Block or alert on the nine published proxy addresses, 101.53.80[.]20, 205.214.59[.]31, 124.155.252[.]63, 154.201.79[.]246, 23.248.249[.]90, 23.158.220[.]98, 103.248.148[.]84, 203.160.133[.]172 and 209.209.85[.]38, plus the LLM reseller domain xcai[.]pro. Deny server subnets egress to LLM API endpoints, because a loan portal has no reason to call DeepSeek, Anthropic or OpenAI, and inventory for ARTEX deployments by Docker image name autumn27/artex or a UI listening on port 8787, requiring the project's intercept-and-approve gating on any sanctioned pentest agent.
Watch the Financial Security Institute's institution and victim counts: anything past seven institutions and 65,000 to 68,000 people, or new data fields beyond loan applications and resident IDs, would widen an incident Korea's regulators already treated as systemic, convening bank meetings after the KB and Hana disclosures. Watch also for the console string or leaked ARTEX session artifacts surfacing in intrusions outside South Korea, and for the repository reappearing under a new name; the project tracker recorded roughly 500 new stars in the six days after attribution, so demand for this tooling is not theoretical.
Timeline
-
update from koreatimes.co.kr
Shinhan Bank hit by data breach affecting 25,000 customers
koreatimes.co.kr · 12d ago · October 1st, 2026
First same-day English coverage of the incident, six days before CrowdStrike framed the campaign as AI-driven. Shinhan Bank apologized after a breach exposed data on about 25,000 customers, including names, phone numbers, annual income, loan eligibility limits, 66 cases involving resident registration numbers and 97 cases of connected information. The bank said an unauthorized external party bypassed authentication, and the Financial Supervisory Service conducted an on-site inspection.
-
update from yna.co.kr
(LEAD) Some 25,000 customers' info leaked from Shinhan Bank in apparent AI agent-assisted hacking
yna.co.kr · 12d ago · October 1st, 2026
Yonhap's lead wire, published the day after the September 30 leak, reports loan records, annual income, names and phone numbers taken from Shinhan's loan borrowing service. Sources said the hackers, suspected to be based overseas, used advanced AI tools, and experts assessed the bank was not specifically targeted but caught in random AI-powered attacks against vulnerable online platforms. This is the earliest reporting of the AI angle that predates the campaign attribution.
-
update from insurancejournal.com
AI Tools Suspected in Korea's Shinhan Bank Hack, Yonhap News Reports
insurancejournal.com · 11d ago · October 2nd, 2026
First substantial international pickup, citing Yonhap: AI agents probably probed for vulnerabilities and accessed a service used by loan recruiters. It already connects the Shinhan breach to smaller leaks at KB Kookmin (119 customers) and Hana Bank (89 customers) and to the Financial Services Commission's meetings with local banks. Genians director Mun Chong-hyun warned that AI tools shared for defensive purposes become a double-edged sword in hacking attempts.
-
update from zendot.org
ARTEX: A Self-Hosted Autonomous Penetration Testing System Written in Go
zendot.org · 10d ago · October 3rd, 2026
Independent write-up of the ARTEX project by GitHub user Autumn-27, published four days before the campaign attribution. It documents an open-source autonomous penetration testing system pairing a Go backend with a Next.js frontend under AGPL-3.0, winner of Baidu's agent+ attack-defense challenge, with 1,450 stars and 261 forks at the time of writing. The piece covers approval-gated agent actions, traffic recording, deployment via Docker image autumn27/artex or a single binary, and a UI on port 8787.
-
update from techtimes.com
Open-Source AI Agent Hacked Seven South Korean Banks, Exposing 65,000 Records
techtimes.com · 8d ago · October 5th, 2026
Two days before this story's first sighting, TechTimes reported the Financial Security Institute confirmed the ARTEX link after tracing attack IP addresses and server logs from Shinhan Bank, the first institution to report. The forensic artifact was the string
ARTEX-自主渗透测试控制台, roughly autonomous penetration testing console, found in the HTML title of a server used in the campaign. It reported attackers spent up to 43 hours undetected, more than 65,000 customers exposed across seven institutions, and a round-the-clock national cybersecurity emergency response activated on October 5. -
update from www.wsj.com
The Morning Risk Report: Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk https://www.wsj.com/risk-compliance-journa
www.wsj.com · 6d ago · October 7th, 2026
The Morning Risk Report: Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk https://www.wsj.com/risk-compliance-journa
via Mastodon https://www.wsj.com/risk-compliance-journal/the-morning-risk-report-hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-21056687?mod=rss_worldnews
-
update from www.crowdstrike.com
(crowdstrike.com) Emergence of AI-Powered Cyber Campaigns: Analysis of ARTEX and LLM-Enhanced Attacks on South Korean Financial Organization
www.crowdstrike.com · 6d ago · October 7th, 2026
(crowdstrike.com) Emergence of AI-Powered Cyber Campaigns: Analysis of ARTEX and LLM-Enhanced Attacks on South Korean Financial Organization
via Mastodon https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
-
update from gbhackers.com
Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets
gbhackers.com · 5d ago · October 8th, 2026
A financially motivated campaign that used agentic AI tools to breach South Korean financial organizations and exfiltrate data. Active from late September to early October 2026, the operation combined ARTEX, an open-source penetration testing platform developed in China, with multiple large language models. Researchers recovered exposed operational files that documented the attacker’s infrastructure, prompts, and […] The post Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from insicurezzadigitale.com
ARTEX is the open source AI agent behind the first agentic attack on South Korean banks
insicurezzadigitale.com · 5d ago · October 8th, 2026
Between 65,000 and 68,000 people are estimated affected, and the key forensic artifact was a Chinese control-console string left on compromised web servers. via Mastodon https://insicurezzadigitale.com/artex-e-lagente-ai-open-source-dietro-il-primo-attacco-agentico-alle-banche-sudcoreane/
-
mentioned by www.crowdstrike.com
This was posted yesterday, if you missed it. Crowdstrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance https://w
www.crowdstrike.com · 5d ago · October 8th, 2026