CrowdStrike disclosed that unknown attackers used the AI penetration tool ARTEX to attack South Korean financial institutions

CrowdStrike Intelligence discovered a targeted attack campaign against South Korean financial institutions, leading to data exfiltration, with activity approximately from late September to early October 2026. The attackers used ARTEX, an open-source agentic penetration testing tool developed in China, combined with large language models to conduct the intrusion. Their controlled open directory contained Claude Code session history, ARTEX configuration files, and Claude memory files, revealing a dual-server architecture with a Hong Kong IP as the primary attack infrastructure, with IP 38.244.50[.]120 hosting the ARTEX instance. This ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, supplemented by GLM-5.3 and Grok 4.6, and the attackers may have accessed DeepSeek via the API proxy xcai[.]pro. The report states that the number of affected institutions has not been confirmed, and the attackers may be Chinese speakers with economic motives, but no attribution to a specific organization was made.