Overview
A Chinese-speaking threat actor conducted a series of cyberattacks against major South Korean financial institutions in early October 2026, targeting Shinhan Bank, KB Kookmin Bank, and Hana Bank. The campaign exposed customer personal data and credit card information and caused operational outages at several institutions. What distinguishes this incident from conventional financial-sector intrusions is the attacker’s documented reliance on AI agents — specifically the ARTEX AI penetration testing suite and Anthropic’s Claude Code — as primary offensive tooling.
The South Korean government convened an emergency meeting and issued calls for immediate hardening of critical IT infrastructure. Security firm CrowdStrike confirmed ARTEX AI’s involvement after discovering open directories on the attacker’s infrastructure containing Claude Code session histories, ARTEX configuration files, and Claude memory artefacts.
Technical Analysis
ARTEX AI was, until recently, an open-source agentic penetration testing framework developed in China. The threat actor’s instance used DeepSeek v4.1-flash as the primary LLM backend, supplemented by GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions. DeepSeek API access was routed through the LLM API proxy and reseller xcai[.]pro, providing a layer of infrastructure indirection.
The exposed session histories gave CrowdStrike significant visibility into the attacker’s tradecraft. Notable operational security failures included:
- Leaving Claude Code session logs in publicly accessible directories
- Using the same AI toolchain to generate a personal résumé, inadvertently exposing name, contact details, date of birth, and a Telegram handle
- No pre-planned monetisation strategy — the actor queried Claude to identify Telegram data-sales channels focused on Korean data markets
CrowdStrike assessed with high confidence that the attacker is likely a 26-year-old individual who studied at the South China University of Technology and is based in Maoming, Guangdong, China. A conflicting date of birth (2007) found in the résumé introduces uncertainty, and researchers caution that the personal details cannot be used to confirm identity definitively.
Following public confirmation that ARTEX had been used in real-world attacks, the project’s developer moved to close-source the codebase and halted further updates.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| AML.T0103 | Deploy AI Agent | ARTEX operated as an autonomous offensive agent |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | Agent tooling used to extract and stage stolen data |
| AML.T0065 | LLM Prompt Crafting | Attacker actively prompted Claude for operational guidance |
| AML.T0040 | AI Model Inference API Access | DeepSeek accessed via third-party API proxy |
| LLM08 | Excessive Agency | AI agents executed intrusion actions with minimal human oversight |
| LLM06 | Sensitive Information Disclosure | Session logs leaked attacker PII and victim data pathways |
Impact Assessment
The campaign directly affected three of South Korea’s largest retail banks and their customers. Personal and financial data was exfiltrated, and system outages disrupted banking services. The incident marks one of the first publicly confirmed cases of an AI agentic framework being used as a primary offensive capability in a financially motivated attack against critical financial infrastructure, raising the baseline threat model for the sector globally.
Mitigation & Recommendations
- Harden external attack surfaces against automated AI-driven reconnaissance; assume agentic tools can chain vulnerabilities without human intervention between steps.
- Threat hunt for ARTEX and Claude Code artefacts — session history files, ARTEX config schemas, and Claude memory files — in incident response workflows.
- Block or restrict LLM API proxy endpoints (e.g.,
xcai[.]pro) and monitor for anomalous outbound API traffic patterns. - Apply the principle of least privilege to any internal systems that interact with LLM APIs or agentic automation frameworks.
- Review open-source AI tooling in your environment; supply chain transitions (open-to-closed-source) do not eliminate previously distributed versions.