China's ARTEX AI Hit
South Korean Banks
Planner and worker agents ran target selection through intrusion continuously. The backend was DeepSeek v4.1-flash, with GLM-5.3 and Grok 4.6 alongside. Exposed servers let investigators reconstruct the campaign.Oct 18, 2026
From late September into early October 2026, South Korean financial institutions were attacked in succession. The tool involved is ARTEX, an AI-agent penetration-testing framework developed in China and published on GitHub. Financial authorities reported leaks at at least nine banks, with roughly 68,000 personal records exposed. ARTEX's main AI backend was DeepSeek v4.1-flash.
- Verified Confirmed in an official blog, repository or primary document
- Vendor-reported The developer's or vendor's own claim, not independently verified
- Third-party tested Independently checked by an outside developer, outlet or measurer
- AIfrontier view Our own interpretation
1. What happenedThird-party tested
The attacks ran from late September to early October against Shinhan Bank, KB Kookmin Bank, Hana Bank and others. Initially, at least seven institutions were reported to have leaked a combined 68,000 records; follow-up investigation widened the set to at least nine banks. At Shinhan Bank roughly 25,000 customers were affected, with names and phone numbers joined by annual income and loan limits. Source: JBpress
The intruders went after peripheral systems rather than core banking: a lookup service for loan brokers, and a mobile work-support system for staff. Korea's financial authorities convened an emergency review on October 4, issued a "caution" consumer alert on October 6, and opened a one-month special period for secondary-harm response. At least one bank has said it will fully compensate any secondary losses.
2. How the attack was structuredThird-party tested
ARTEX is not a model. It is a multi-agent security-testing platform that orchestrates external LLMs, built by a Chinese security developer (Autumn-27) for enterprise vulnerability assessment and released under AGPL-3.0.
Per CrowdStrike, the operator used a Hong Kong-based server as the campaign backbone, with a separate host running the ARTEX instance. The Hong Kong address exposed Claude Code session histories, Claude memory files and ARTEX configuration files. Source: The Hacker News (CrowdStrike analysis)
| Item | Detail |
|---|---|
| ARTEX's AI backend | DeepSeek v4.1-flash as the main model, with Z.ai's GLM-5.3 and Grok 4.6 as supplements |
| The operator's other tooling | Anthropic's Claude Code, also reportedly used to search for Telegram groups selling Korean data |
| How the models were reached | Possibly through an LLM API reseller, "xcai.pro" |
| Attribution | Not attributed to a known actor. Suspected Chinese-speaking operator, financially motivated |
| Mechanism | A "planner" sequences the work; "worker" agents do the recon and execution — no human instruction needed between stages |
The important shift is that each stage of the intrusion is automated. Reconnaissance, vulnerability identification and the intrusion path — work that once required a skilled human — run continuously. That is what JBpress means by an era in which hacking no longer requires expertise.
3. Detection and responseThird-party tested
The picture was reconstructed from exposed servers. Shared IP addresses across several institutions led authorities to investigate whether one actor targeted multiple banks.
Korea's AhnLab found that with v2, ARTEX has evolved into a planner-and-worker multi-agent platform, with a shared workspace, reports, external tool integration and reusable functions — from a single-purpose automation tool into a platform that coordinates many agents' work, tools and data. AhnLab warns that the spread of such tooling lowers the expertise needed to attack. Source: Seoul Economic Daily (AhnLab analysis)
| System observed | Count |
|---|---|
| ARTEX login screens | 394 |
| Sub2API (relays access to AI services) | 252 |
| Scope Sentry (internet-exposed asset scanning) | 22 |
| CyberStrikeAI (another AI pentesting tool) | 15 |
ARTEX is not sitting in a lab: it is deployed on internet-reachable servers alongside other tooling. AhnLab cautions, though, that finding several tools together does not by itself identify one operator or group.
4. The developer pulled the projectVerified
After the misuse surfaced, the developer Autumn-27 announced that ARTEX would stop public development and go closed source, stating that the malicious attacks had nothing to do with them and that abuse violates the tool's original purpose. Source: The Hacker News
— Autumn-27
No further versions or maintenance support will be released. But published code cannot be recalled: the AGPL-3.0 release has already spread and forks may exist. What changes is not the existence of such tools but their visibility from public channels.
5. Spillover to JapanThird-party tested
JBpress notes that Japan, too, has seen incidents in which generative AI was used to write hacking programs — the Korean case is not a distant one. In Japan, IPA along with the communications ministry and NICT continue scanning for devices left on weak passwords and warning their owners.
What separates this incident from earlier breaches is that target selection through execution runs continuously under AI. Intrusion previously depended on human knowledge of exploit steps. Tooling like ARTEX removes that dependency — and so removes the defender's assumption that attackers are skilled and time-constrained.
6. What it adds up toAIfrontier view
Three things make this emblematic. (1) AI moved the bottleneck in attacking. The mechanics are automated; what remains is choosing the target — which is precisely the role of the decision-model layer this site has been tracking. (2) Attackers do not need frontier models. The backend was DeepSeek v4.1-flash with GLM-5.3 and Grok 4.6 alongside. Cheap, capable open-weight models change the economics of offence. (3) The weakest link sat next to the crown jewels. Entry came through a broker lookup service and a staff mobile system, not core banking.
Three practical preparations. (1) Inventory the paths outside the core. Hardening the core while a neighbouring lookup service stays open just relocates the door. (2) Continuously enumerate internet-exposed assets. AhnLab counted 214 exposed systems because that is how attackers search too. (3) Govern the logs of your own AI coding tools. The decisive evidence here came from exposed Claude Code sessions — meaning your AI usage logs can leak the same way. Cloudflare's identity-aware gateways, covered separately on this site, read differently in that light.
Sources
- JBpress (Lee Jung-sun), "The threat of Chinese AI ARTeX that hit Korean banks: the era of hacking without expertise" (Oct 12, 2026) https://jbpress.ismedia.jp/articles/-/97451
- The Hacker News, "ARTEX Goes Closed Source" (CrowdStrike Intelligence analysis; exposed Claude Code sessions; ARTEX composition) https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html
- CrowdStrike, "Unknown threat actor uses ARTEX to target South Korean finance" https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
- Seoul Economic Daily, "AI Penetration Tool ARTEX Evolves Into Multi-Agent Platform, AhnLab Says" (observed system counts) https://en.sedaily.com/technology/2026/10/09/ai-hacking-tool-artex-evolves-into-multi-agent-platform
- Korea Financial Services Commission press release (consumer caution) https://www.fsc.go.kr/eng/pr010101/87887
- ARTEX developer (GitHub: Autumn-27 / notice of discontinued public development) https://github.com/Autumn-27