Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

This threat involves a financially motivated, likely Chinese-speaking threat actor conducting targeted attacks against South Korean financial institutions using ARTEX, a Chinese-developed open-source agentic penetration testing tool, augmented by large language models (DeepSeek v4.1-flash, GLM-5.3, Grok 4.6). The attacker leveraged AI to increase operational tempo, enabling multiple intrusions within a short timeframe. Exposed directories contained ARTEX configuration files and Claude Code session histories, revealing a two-server architecture with infrastructure based in Hong Kong. The adversary also investigated Korean data breach marketplaces and Telegram channels for selling stolen information. Indicators include multiple IP addresses and a domain associated with the campaign. There is no known CVE or exploit code associated with this threat, and no patch or remediation is applicable as this is an active threat actor campaign rather than a software vulnerability.

The threat actor successfully exfiltrated data from targeted South Korean financial institutions, indicating a breach of confidentiality and potential financial and reputational damage. The use of AI-driven tools allowed rapid and multiple intrusions, increasing the scale and speed of compromise. The actor's research into data marketplaces suggests intent to monetize stolen information, posing ongoing risk to affected entities and their customers.

No specific patch or fix applies as this is an active threat actor campaign rather than a software vulnerability. Organizations should focus on detection and response capabilities tailored to the tactics, techniques, and procedures (TTPs) observed, including monitoring for ARTEX-related activity and AI-powered attack patterns. Review and harden access controls, network segmentation, and incident response plans. Refer to vendor advisories and threat intelligence updates for evolving indicators and recommended defensive measures.