Threat Intel
Chinese Hacker Uses ARTEX AI and Claude Agents to Target South Korean Banks
A Chinese-speaking hacker launched attacks on South Korean banks using ARTEX AI and Claude agents, exposing customer data and causing outages. The attacks targeted Shinhan, KB Kookmin, and Hana banks, revealing LLM-based probing techniques. Defenders should audit for ARTEX AI usage, secure exposed directories, and monitor LLM API traffic.
What happened
A Chinese-speaking hacker launched a series of attacks against major South Korean banks earlier this month, using the ARTEX AI penetration testing suite and Claude agents to probe and exploit systems. The actor targeted Shinhan Bank, KB Kookmin Bank, and Hana Bank, exposing personal data, credit card information, and causing service outages in some cases.
Impact
Customer data was exposed, including names, account numbers and card details. Several banking services were disrupted, leading to downtime and loss of customer trust. The South Korean government convened an emergency meeting and urged immediate security hardening of critical IT infrastructure.
Technical details
The attacker ran an ARTEX AI instance backed by DeepSeek v4.1‑flash, supplemented with GLM‑5.3 (Zhipu AI) and Grok 4.6 for Claude Code sessions. Infrastructure analysis revealed open directories containing Claude session histories, ARTEX configuration files, and memory dumps, indicating the attacker’s use of LLM APIs via the xcai.pro proxy.
The attacker likely accessed DeepSeek via the LLM API proxy/reseller xcai.pro.
What defenders should do
- Audit your environment for ARTEX AI or other LLM‑based penetration tools and verify that no unauthorized instances are running.
- Check for exposed directories that may contain session logs or configuration files and secure them immediately.
- Validate that all banking applications are patched and that API access to LLM services is tightly controlled.
- Implement monitoring for anomalous outbound traffic to LLM API endpoints such as xcai.pro.
- Conduct a rapid review of customer data exposure controls and notify affected individuals if necessary.
Mitigation steps
Apply any available patches for banking software, enforce least‑privilege access, and enable logging for all external API calls. Consider deploying network segmentation to isolate critical banking services from potential LLM‑based probing tools.
Related articles
AI‑Driven ARTEX Campaign Targets South Korean Financial Institutions – Defenders Must Harden Endpoints
CrowdStrike Intelligence identified an AI‑driven ARTEX campaign that compromised multiple South Korean banks, exfiltrating sensitive data. The attack used phishing and legacy software exploits to gain foothold. Defenders should update Falcon agents, block malicious IPs, enforce MFA, and monitor for ARTEX signatures.
Read briefing
AI-Driven ARTEX Campaign Targets South Korean Financial Institutions
A covert threat actor deployed the AI‑powered ARTEX tool to infiltrate South Korean banks, exfiltrating sensitive data. CrowdStrike intelligence mapped the infrastructure and identified the attack vectors. Defenders should harden endpoint detection, monitor for ARTEX signatures, and enforce strict network segmentation.
Read briefing
AI‑Driven ARTEX Campaign Targets South Korean Financial Institutions
A previously unknown threat actor leveraged the AI‑powered ARTEX framework to infiltrate South Korean banks, exfiltrating sensitive data. CrowdStrike’s intelligence identified the command‑and‑control infrastructure and highlighted the need for heightened monitoring of AI‑generated malware. Defenders should review endpoint logs, block known ARTEX signatures, and enforce strict network segmentation.
Read briefing
North Korean APT Breaches South Korean Media and Auto Firms via New Linux Toolkit on HAProxy Load Balancers
A suspected North Korean APT deployed a previously undocumented Linux espionage toolkit, dubbed "TED," to compromise HAProxy load balancers in South Korean media and automotive companies. The attackers leveraged the compromised appliances to harvest credentials, redirect traffic, and execute drive‑by downloads, fitting the DPRK pattern of long‑term espionage via trusted software. Rapid7 links the activity to APT37 with medium confidence, highlighting the dual focus on information control and manufacturing IP.
Read briefing