A Chinese-speaking hacker launched cyberattacks that shook the South Korean financial sector earlier this month, using the ARTEX AI penetration testing suite and Claude agents.
The actor targeted multiple Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, exposing clients ' personal data and credit card information, and causing system outages in some cases.
The South Korean government reacted with an emergency meeting and calls for immediate security measures for critical IT systems.
Security firm CrowdStrike confirmed the use of ARTEX AI, up until recently an open-source agentic penetration testing suite developed in China.
Researchers identified the attacker's infrastructure and found open directories with Claude Code session histories, ARTEX configuration files, and Claude memory files.
“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.
“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” the researchers noted.