MalwarePublished 4 Nov 2026

ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack

Source AlienVault OTX General

Mentions 2 CVEs

Mentioned vulnerabilities

Description

Between late September and early October 2026, seven South Korean financial institutions were breached, impacting around 66,000 individuals and 2,200 corporations. The attacks were linked to ARTEX, an AI-driven autonomous penetration testing framework. Investigations uncovered exposed infrastructure hosting AI model-routing components, exploitation tools, and proxy management utilities. The operation leveraged multiple AI models and included various attack artifacts such as reconnaissance tools, exploitation chains, privilege escalation exploits, and scripts targeting cryptocurrency exchanges and mobile devices. The infrastructure spanned multiple countries with over 1,300 IP addresses identified.

Impact

The breaches compromised seven financial institutions in South Korea, affecting approximately 66,000 individuals and 2,200 corporations. The use of AI-driven autonomous penetration testing tools and multiple exploitation techniques indicates a sophisticated attack capable of reconnaissance, privilege escalation, and access to cryptocurrency exchange systems. The exposure of infrastructure and tools increases the risk of further exploitation or related attacks. No confirmed active exploits in the wild are reported for the associated CVEs.

Defensive guidance

Organizations should review and secure exposed infrastructure components, especially those related to AI model routing and proxy management. Monitoring and restricting access to known malicious IP addresses and domains associated with ARTEX infrastructure is recommended. Given the lack of confirmed patches, organizations should apply best practices for securing exposed services and promptly investigate any signs of compromise.

Summary

The ARTEX autonomous penetration testing framework was used to conduct intrusions against seven South Korean financial institutions, resulting in significant data exposure affecting tens of thousands of individuals and corporations. The exposed infrastructure included AI model-routing components, custom Claude Code skills, proxy utilities, and exploitation tooling. The attackers utilized AI models like DeepSeek, GLM, and Grok via the xcai.pro reseller domain. Recovered artifacts indicate the use of FOFA reconnaissance tools, JNDI/LDAP exploitation chains, Linux privilege escalation exploits, cryptocurrency exchange access scripts, and mobile device utilities. The infrastructure was distributed globally, identified through multiple IP addresses and domains.

Indicators of compromise

Domains 4

xcai.pro
fofoapi.com
direct.xcai.pro
u6ud2s.dnslog.cn

URLs 1

https://fofoapi.com/api/v1/search/all

IP addresses 6

23.248.226.250
202.95.14.60
38.244.50.120
130.94.31.86
149.88.85.20
118.107.47.11

Hashes 1

c7a884afcd7f91408921890d9617bef6bfac3dae992bc25bb9c48c0395a60842

CVEs 2

CVE-2022-2588
CVE-2025-5054

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Nov 2026, 19:59 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details