Hunt.io traces ARTEX AI tools to South Korean bank breaches

About 66,000 to 67,000 individuals and around 2,200 corporations were affected by intrusions at seven South Korean financial institutions between late September and early October 2026 that exposed personal, employment, income and loan data through internet-facing systems. Hunt.io traced ARTEX infrastructure and AI-powered hacking tools used in those intrusions.

Intrusions affected about 66,000 to 67,000 individuals and around 2,200 corporations, and the exposed information included names, contact details, e-mail addresses and national identification numbers. On Oct. 14, 2026, South Korea’s Financial Services Commission said intrusions affected 16 financial institutions and roughly 100,000 records containing personal information had leaked. The regulator stated no leaked account passwords or card numbers had been identified that would directly permit unauthorized transactions, and authorities were still examining whether the incidents were connected and whether AI had been involved.

Hunt.io alerted the relevant national CERT before publishing its analysis and said its report holds no personal records or credentials. The firm published indicators of compromise in its analysis. ARTEX, built in China under the AGPL-3.0 license, is an autonomous penetration testing framework with open-source code, meaning software that can plan and run security tests without direct human control. Genians said the ARTEX GitHub repository and Docker image were removed on Oct. 11, 2026, though forks and mirrors remain.

DeepSeek v4.1 Flash was the primary AI model used with the framework, with GLM 5.3 and Grok 4.6 as backups, and the models were reached partly through the reseller domain xcai[.]pro. CrowdStrike, with moderate confidence, judged that one Chinese-speaking person driven by financial gain operated ARTEX, not an established threat group.

A public indicator was a server at 38.244.50[.]120 that hosted the ARTEX console. Hunt.io scanning found the server on Cogent’s network in Los Angeles with 15 open ports, and the ARTEX login page appeared on ports 443 and 8090. Public indicators included a Hong Kong address and nine proxies.

Hunt.io’s AttackCapture platform found an open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. The directory held 42 files in two subdirectories totaling 105 MB, and the platform logged warnings on Sept. 5, 2026, Sept. 26, 2026 and Oct. 5, 2026.

One file named 38.244.50[.]120 as the jump host and told the operator never to paste credentials into a session. Three scripts kept reverse SSH tunnels alive, ran a local relay and copied files to the jump host, with one tunnel named grok2api. A credentials file held keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. A state file showed the harness was Claude Code version 2.1.221, started 510 times since Aug. 4, 2026, and not talking to Anthropic; Claude Code is Anthropic’s AI coding tool.

A proxy called ds-models-shim.py faked a model list and sent requests to DeepSeek. A script called xcai-effort-shim.py added a reasoning setting because the DeepSeek backend otherwise skipped its reasoning step. The route ran from Claude Code through Claude Code Router to xcai and then to DeepSeek. The file counted 19 custom skills with 147 recorded uses.

Capabilities included code audit, reconnaissance and web injection, along with WAF bypass and authentication testing; WAF refers to web application firewall. Skills targeted Telegram Mini Apps, APK decompiling, cloud phone control and payment logic. Three test accounts registered by the operator held tokens for a cash-in deposit API dated Sept. 12, 2026. A comment called the test accounts an authorized, self-built test suited to insecure direct object reference tests on Korean loan and inquiry services.

A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API using a backup key after the primary membership expired. Proxy scripts found 79 unique exit IPs at a rotating proxy service at 154.201.79[.]246:443. A directory at 23.248.226[.]250:8001 contained JNDI and LDAP exploitation tools retrieved on Oct. 5, 2026 at 03:42 UTC, and one script let web and LDAP traffic together; JNDI and LDAP are directory and lookup protocols.

Hunt.io described the tooling without publishing steps to reproduce it, and other recovered files targeted a cryptocurrency exchange’s admin session and withdrawals. Hunt.io said the connection of those files to the Korean breaches is not confirmed.

A certificate-issuer search found 19 IP addresses including 38.244.50[.]120, and a malware-name search returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Title matching yielded about 1,300 IP addresses, and a looser search found 21 title strings, 19 likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese. An AttackCapture malware-name search found 280 open directories.

An open directory at 130.94.31[.]86:18888 in Seoul contained two scripts, and a host at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes artex_probe_11876.txt. Other hosts held exploitation kits for DedeCMS and FangCMS, an exploit targeted RuoYi and Spring administrative consoles, and CAPTCHA-based login automation also appeared among the hosts.

Hunt.io said an investigation should not stop at the first list of indicators. Investigators identified the same Chinese-developed AI tool in cyber attacks on Japanese companies. GMO Cybersecurity by IERAE said on Oct. 19, 2026 that investigators confirmed ARTEX use after examining attack servers. Investigators initially found one overseas server running ARTEX targeting approximately 20 Japanese companies, nine of them in the same industry; they later found five more overseas servers running ARTEX, raising the count to six servers aimed at roughly 80 Japanese companies.

The Japanese companies spanned retail, digital gifts, education, printing, insurance, finance, e-commerce and logistics. Eight targeted Japanese companies publicly disclosed cyber attacks between Sept. 18, 2026 and Oct. 18, 2026. Investigators saw similarities involving ARTEX configurations and targeted industries, suggesting the six servers might have come from one group, but they have not established that the same attacker operated in Japan and South Korea. GMO shared its findings with law enforcement.

Lawson reported that personal information tied to over two million accounts had leaked. Yamato Transport confirmed that roughly 5.26 million customer information records were stolen from its payment-after-delivery service and said on Oct. 21, 2026 that it investigated with outside specialists but declined to disclose attack methods or tools. GMO Research & AI said its infoQ survey platform lost 894,082 personal information records to hackers and that customer reward points were exchanged without authorization for Amazon gift codes. No public connection has been established by any of those Japanese companies between a disclosed breach and the ARTEX tool.

ARTEX was originally built for authorized security testing and can use AI to plan tests, identify vulnerabilities and direct other software to exploit them.

CrowdStrike, assessing with moderate confidence, said the financially motivated, likely Chinese-speaking attacker was not a named hacking group. CrowdStrike stated, “This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span.” The total number of affected organizations remains unconfirmed, CrowdStrike said.

Defenders should remove public access and place administration behind VPNs or allowlists. They should reset SSH passwords and rotate proxy credentials, tokens and API keys that exposed files might have revealed. Defenders should watch for unexpected activity involving LDAP and JNDI, remote script downloads and DNS callbacks, store secrets in a managed vault with least-privilege permissions, and restrict access to model gateways while monitoring their requests.