CrowdStrike investigated data-exfiltration activity associated with South Korean financial organizations and found two related attacker-controlled systems. One hosted an ARTEX penetration-testing agent; another exposed open directories containing Claude Code conversations, ARTEX configuration, memory files and instructions in CLAUDE.md. The accidental…
Inspect the ClaimsCase · DiggingBeagle record
ARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs
CrowdStrike linked late September to early October 2026 data-exfiltration attacks against South Korean finance organizations to ARTEX and other AI tools. Attacker-controlled open directories exposed the operator's own Claude Code sessions and ARTEX configuration. Victim count, attributable identity, precise model autonomy and monetary loss remain unconfirmed.
Scope
Reported operational campaign against South Korean financial organizations in late September and early October 2026, investigated through threat actor-controlled infrastructure and exposed operator sessions. Evidence does not establish that Claude Code or ARTEX providers were breached, that the publicly accessible directories were victim-owned, or that all reported targets were successfully compromised.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- AI role
- WITH AI
Basis and provenance
First-party threat intelligence reports real exfiltration activity and directly inspected attacker-side agent configuration and histories; secondary reporting adds targeted-bank and developer-status context. The precise role of each model and verified successful victim count remain unknown, and the public report does not reproduce each victim intrusion independently. Observed live refers to the operational campaign, not a proven fully autonomous model exploit. No verified monetary loss or defensible impact band. Ending public ARTEX releases is not a remediation of compromised banks or every installed instance.
Assessed Oct 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ARTEX-ATTACK-CAMPAIGN · CLM-ARTEX-OPERATOR-LOG-LEAK · CLM-ARTEX-TARGETS-NOT-VICTIMS · CLM-ARTEX-TWO-SERVER-TOPOLOGY · CLM-ARTEX-ATTRIBUTION-SCOPE · Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance · Chinese developer makes ARTEX AI agent closed-source after Korean bank hack
At a glance
The attacker-side leak and the AI-assisted offensive campaign meet at the harness but are not the same failure. A publicly readable operator directory yielded configuration, memory, system instructions and session histories to investigators; the documented prerequisite was exposed server-side files, not a jailbreak or Anthropic service compromise. A…
Read the implicationsThe number and identities of successfully breached organizations and the volume of exfiltrated records were not reliably established. The record does not prove that every reported bank attack resulted from ARTEX rather than other tools or human activity. Actor identity and nationality are not confirmed; do not publish personal data extracted from the…
Limits and uncertaintyFull account
CrowdStrike investigated data-exfiltration activity associated with South Korean financial organizations and found two related attacker-controlled systems. One hosted an ARTEX penetration-testing agent; another exposed open directories containing Claude Code conversations, ARTEX configuration, memory files and instructions in CLAUDE.md. The accidental exposure of the operator's own agent state provided researchers with visibility into attacker behavior. It is different from leaking Anthropic's Claude Code source code or a victim's chat history.
CrowdStrike associates the ARTEX instance with a DeepSeek v4.1-flash backend and reports separate Claude Code sessions involving GLM-5.3 and Grok 4.6. These are its observations about a combined human-operated toolchain, not evidence that one model independently selected victims, executed the entire campaign or bypassed all authorization boundaries. Researchers describe queries about monetizing Korean breach data, but published content does not prove completed data sales.
The number of affected organizations remains uncertain. Reuters on October 9 counted at least nine banks disclosed or reported as targets, a different denominator from confirmed breaches. CrowdStrike did not name the actor definitively; personal details appearing in a generated résumé prompt are not reliable identity proof and are deliberately excluded from this Case. The developer later said ARTEX would stop public updates and maintenance and become closed-source, and Reuters found its public GitHub page unavailable. This change does not undo copies already distributed, establish a patch or prove the tool was inherently malicious.
The distinctive security mechanism here is the exposed operational harness: session histories and configuration on reachable attacker infrastructure yielded forensic traces to investigators. The misuse of an agentic pentesting tool, the visibility leak in the operator environment and the breaches of finance organizations are connected observations, but their causal paths are different and should not be merged into a generic AI prompt injection incident.
Claims & evidence
CLM-ARTEX-LLM-STACKCrowdStrike described a two-server operator setup with an ARTEX instance using DeepSeek v4.1-flash as primary backend and supplementary Claude Code sessions invoking GLM-5.3 and Grok 4.6. This documents mixed AI-assisted offensive workflow, without proving end-to-end autonomous attack execution.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
ARTEX Infrastructure Analysis, paragraph on two-server architecture and named backend models
CLM-ARTEX-CLOSED-SOURCEFollowing reports of misuse, the ARTEX developer said public releases and maintenance would stop and the project would become closed-source; Reuters could no longer find the original GitHub page on October 9, 2026.supported
Basis: reported finding
- supportsChinese developer makes ARTEX AI agent closed-source after Korean bank hacksecondary reporting
October 9 paragraphs citing the developer statement and reporting repository removal
CLM-ARTEX-IDENTITY-LIMITCrowdStrike did not attribute this campaign to a named adversary and stated that personal details in a prompted résumé could not be definitively associated with the operator.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
Opening attribution assessment and Possible Threat Actor Details final paragraph
CLM-ARTEX-ATTACK-CAMPAIGNCrowdStrike identified attacker infrastructure associated with a late September to early October 2026 campaign against South Korean financial organizations that resulted in exfiltrated data. It did not confirm the number of affected organizations.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
Opening summary and Details paragraphs on data exfiltration and unspecified affected-organization total
CLM-ARTEX-ATTRIBUTION-SCOPECrowdStrike states the actor is unidentified and its Chinese-language and financial-motivation attribution is an assessment with moderate confidence. The open sessions support tool use and infrastructure correlation but the article does not provide a complete verified per-victim command sequence attributable to the models.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
Lead and Details, paragraph beginning While this activity has not been attributed; ARTEX Infrastructure Analysis and Assessment
CLM-ARTEX-OPERATOR-LOG-LEAKInvestigators found unauthenticated directories on infrastructure they attributed to the threat actor containing Claude Code session histories, ARTEX configuration, memory files and a CLAUDE.md instruction file. These are attacker-side operational traces, not confirmed customer chat leaks from the AI provider.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
ARTEX Infrastructure Analysis, paragraphs identifying the ARTEX server and Hong Kong system with open directories
CLM-ARTEX-TARGETS-NOT-VICTIMSReuters reported on October 9 that at least nine South Korean banks had disclosed or were reported as targets since late September; this is not nine independently confirmed successful breaches, and no defensible victim total or monetary loss was established.supported
Basis: reported finding
- supportsChinese developer makes ARTEX AI agent closed-source after Korean bank hacksecondary reporting
October 9 report paragraph beginning At least nine South Korean banks
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
Details paragraph: number of affected organizations remains unconfirmed
CLM-ARTEX-TWO-SERVER-TOPOLOGYCrowdStrike describes an ARTEX instance on one actor-controlled host and a second, Hong Kong-based host that exposed Claude Code session histories, ARTEX files and memory. The prompt file on the ARTEX host contained Chinese-language instructions for penetration-testing activity; both locations were attributed to the operator rather than to Anthropic customers.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
ARTEX Infrastructure Analysis, paragraphs beginning The IP address 38.244.50[.]120 and Analysis of the Hong Kong-based IP address
CLM-ARTEX-MONETIZATION-PROMPTSCrowdStrike reports that the operator asked Claude where Korean breach data is typically sold and sought Telegram group recommendations. These queries establish what the operator requested, not that a model facilitated an actual sale or that records were sold.supported
Basis: reported finding
- supportsUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Financeprimary disclosure
ARTEX Infrastructure Analysis, final paragraph before Possible Threat Actor Details
Implications
The attacker-side leak and the AI-assisted offensive campaign meet at the harness but are not the same failure. A publicly readable operator directory yielded configuration, memory, system instructions and session histories to investigators; the documented prerequisite was exposed server-side files, not a jailbreak or Anthropic service compromise. A separate question is which tool calls actually reached the South Korean targets: preserved prompts identify model requests, while a confirmed exploitation chain would additionally need execution logs, target telemetry and correlation to exfiltration. A role-specific review should identify the human operator, ARTEX runner, model APIs and accessible infrastructure separately. Compare the distinct Claude Code release-artifact exposure and repository harness-configuration survey rather than treating all three as proof of the same vulnerability. Session archive access controls and removal of directory listings reduce accidental trace exposure; they do not remove malicious binaries already copied or prevent the actor from using a different agent.
Unknowns and contradictions
- The number and identities of successfully breached organizations and the volume of exfiltrated records were not reliably established.
- The record does not prove that every reported bank attack resulted from ARTEX rather than other tools or human activity.
- Actor identity and nationality are not confirmed; do not publish personal data extracted from the operator logs.
- The exposed directories reflect attacker-side security failure; no compromise of Claude Code as a service was established.
- No public source measured financial loss or proved that the malicious activity continued after the developer stopped releases.
Sources and citation
Material revision history
- Oct 9, 2026 · Published version · first publication · revision 114