Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

Evidence record

October 7 first-party threat-intelligence analysis of late September to early October 2026 South Korean financial intrusions. CrowdStrike describes attacker-controlled open directories containing Claude Code session histories, ARTEX configuration, Claude memory and a CLAUDE.md prompt; correlates two servers and mixed AI backends. It does not confirm the number of affected organizations or definitively identify the actor.

Read the original source ↗

Claim-level citations (8)

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike described a two-server operator setup with an ARTEX instance using DeepSeek v4.1-flash as primary backend and supplementary Claude Code sessions invoking GLM-5.3 and Grok 4.6. This documents mixed AI-assisted offensive workflow, without proving end-to-end autonomous attack execution.

  ARTEX Infrastructure Analysis, paragraph on two-server architecture and named backend models

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike did not attribute this campaign to a named adversary and stated that personal details in a prompted résumé could not be definitively associated with the operator.

  Opening attribution assessment and Possible Threat Actor Details final paragraph

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike identified attacker infrastructure associated with a late September to early October 2026 campaign against South Korean financial organizations that resulted in exfiltrated data. It did not confirm the number of affected organizations.

  Opening summary and Details paragraphs on data exfiltration and unspecified affected-organization total

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike states the actor is unidentified and its Chinese-language and financial-motivation attribution is an assessment with moderate confidence. The open sessions support tool use and infrastructure correlation but the article does not provide a complete verified per-victim command sequence attributable to the models.

  Lead and Details, paragraph beginning While this activity has not been attributed; ARTEX Infrastructure Analysis and Assessment

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: Investigators found unauthenticated directories on infrastructure they attributed to the threat actor containing Claude Code session histories, ARTEX configuration, memory files and a CLAUDE.md instruction file. These are attacker-side operational traces, not confirmed customer chat leaks from the AI provider.

  ARTEX Infrastructure Analysis, paragraphs identifying the ARTEX server and Hong Kong system with open directories

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: Reuters reported on October 9 that at least nine South Korean banks had disclosed or were reported as targets since late September; this is not nine independently confirmed successful breaches, and no defensible victim total or monetary loss was established.

  Details paragraph: number of affected organizations remains unconfirmed

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike describes an ARTEX instance on one actor-controlled host and a second, Hong Kong-based host that exposed Claude Code session histories, ARTEX files and memory. The prompt file on the ARTEX host contained Chinese-language instructions for penetration-testing activity; both locations were attributed to the operator rather than to Anthropic customers.

  ARTEX Infrastructure Analysis, paragraphs beginning The IP address 38.244.50[.]120 and Analysis of the Hong Kong-based IP address

• supportsARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logs: CrowdStrike reports that the operator asked Claude where Korean breach data is typically sold and sought Telegram group recommendations. These queries establish what the operator requested, not that a model facilitated an actual sale or that records were sold.

  ARTEX Infrastructure Analysis, final paragraph before Possible Threat Actor Details