Chinese hacker weaponizes ARTEX AI and Claude agents in coordinated assault on South Korean banks

Earlier this month, a Chinese-speaking attacker orchestrated a wave of intrusions targeting South Korea's banking infrastructure using the ARTEX AI penetration testing framework alongside Claude agents. The campaign struck multiple major institutions, among them Shinhan Bank, KB Kookmin Bank, and Hana Bank, resulting in the compromise of customer personal information and payment card details, with some targets experiencing operational disruptions.

The South Korean government convened an emergency session and issued directives for enhanced security protocols across vital information technology infrastructure in response to the incidents.

CrowdStrike's threat intelligence team verified the deployment of ARTEX AI, which until recently remained publicly available as an open-source agentic penetration testing platform originating from China. Investigation of the attacker's exposed systems uncovered unprotected directories containing Claude Code session logs, ARTEX setup parameters, and Claude memory records.

According to CrowdStrike, "The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions."

The researchers further noted that "The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro."

The exposed materials revealed substantial overlap between the attacker's targets and financial sector breaches documented in earlier investigations, enabling researchers to establish high-confidence attribution. The threat actor's careless handling of credentials extended to using the same AI infrastructure to generate a curriculum vitae, inadvertently disclosing personal identification, contact information, and a Telegram account identifier.

CrowdStrike assessment suggests the individual may be a 26-year-old national of China with educational background at the South China University of Technology, currently residing in Maoming, Guangdong. The researchers cautioned, however, that an earlier résumé entry listed a birth year of 2007, casting doubt on the reliability of these biographical details for definitive identification purposes.

Evidence from the attacker's records indicates no predetermined strategy for monetizing the compromised financial data. The threat actor instead solicited Claude's assistance in identifying Telegram channels specializing in the sale of information related to Korea.

Following confirmation that ARTEX had been deployed in active attacks, the project's original developer transitioned the codebase to closed-source status and halted ongoing development efforts. Nevertheless, the existing iteration has spawned English and Korean language variants, ensuring the toolkit remains accessible despite the developer's decision to restrict future releases.