A Chinese-speaking hacker launched cyberattacks that rocked South Korea’s financial sector earlier this month using the ARTEX AI penetration testing suite and Claude agents.
The perpetrator targeted several Korean banks, including Shinhan Bank, KB Kookmin Bank and Hana Bank, by exposing customers’ personal and credit card information and in some cases causing system failures.
The South Korean government responded with an emergency meeting and called for immediate security measures for critical IT systems.
Security company CrowdStrike confirmed the use of ARTEX AI, an open source agent penetration testing suite developed until recently in China.
Researchers identified the attacker’s infrastructure and found open directories containing Claude code session histories, ARTEX configuration files, and Claude save files.
“The ARTEX instance used DeepSeek v4.1 Flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude code sessions,” CrowdStrike explained.
“The threat actor likely accessed DeepSeek through the likely LLM API proxy/reseller xcai(.)pro,” the said Researchers noticed.
These records also provided insight into the attacker’s activities, with targets overlapping with those identified in previous financial sector breach reports, providing highly reliable linkage.
Because the threat actor used the same AI tools to create a resume, he also exposed identification, contact and Telegram account data.
Based on resume information, CrowdStrike says the attacker may be a 26-year-old Chinese man who studied at the South China University of Technology and lives in Maoming, Guangdong, China.
However, researchers found that the attacker had initially given a birth date in 2007. Although the personal information may belong to the person behind the ARTEX-related activity, it is not reliable enough to confirm the identity of the threat actor.
The records indicate that the attacker had no specific plan to monetize the data stolen from South Korean banks and asked Claude to suggest Telegram data sales groups focused on Korea.
After confirming that ARTEX had been used in real-world attacks, the The developer decided to create the project as a closed source project and post further updates.
However, the current code of the project was used to create it English and Korean language derivativestherefore it remains available in its current form.
