ARTEX AI, Claude agents used in cyberattacks on South Korean banks

The cyberattacks targeting South Korean banks were carried out by a Chinese-speaking threat actor using the ARTEX AI open-source penetration testing suite and Claude agents. CrowdStrike researchers identified the attacker’s infrastructure, including open directories containing session histories and configuration files related to ARTEX and Claude. The ARTEX instance used multiple large language models (DeepSeek v4.1-flash, GLM-5.3, Grok 4.6) accessed via an API proxy. The attacker targeted major South Korean banks, resulting in data exposure and system outages. The attacker’s personal details were partially uncovered but are not fully reliable. Following these attacks, the ARTEX AI developer discontinued the project and made it closed-source, though derivatives remain publicly available.

The attacks led to the exposure of personal and credit card information of clients at multiple South Korean banks and caused system outages. This compromises customer privacy and disrupts banking operations. The attacker did not have a clear monetization plan for the stolen data but sought Telegram data-sales groups focused on Korea. The incident prompted an emergency response from the South Korean government to secure critical IT systems.

No official patch or fix applies as this is an attack campaign using existing AI tools rather than a software vulnerability. The ARTEX AI project has been discontinued and made closed-source by its developer to prevent further misuse. Organizations should apply immediate security measures to protect critical IT infrastructure as recommended by South Korean authorities. Monitoring for use of ARTEX AI and Claude agents in penetration testing or attack simulations may help detect similar threats.