ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Summary: CrowdStrike Intelligence reported a campaign active from late September to early October 2026 that used ARTEX, an open-source agentic penetration testing tool developed in China by Autumn-27, alongside large language models to exfiltrate data from South Korean financial firms including Shinhan Bank and Yegaram Savings Bank. The campaign was uncovered through open directories at a Hong Kong-based IP address exposing Claude Code session histories, Claude memory files, and ARTEX configuration files, with the ARTEX instance using DeepSeek v4.1-flash as its main LLM backend supplemented by Z.ai's GLM-5.3 and SpaceXAI's Grok 4.6.
What's compelling: The operator used the same Claude sessions to ask where Korean breach data is sold and to hunt for Korean Telegram data sales groups, and South Korea's Financial Services Commission and Financial Supervisory Service have warned consumers about phishing and loan scams stemming from the leaked data. Autumn-27 has since taken ARTEX closed source and ended all updates and support, so the tool that carried out these breaches is no longer maintained but remains in circulation.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026