CrowdStrike Links AI Pentest Tool ARTEX to Attacks on South Korean Banks
CrowdStrike Intelligence has identified infrastructure tied to a campaign against South Korean financial organizations in which an unknown threat actor used ARTEX, an open-source agentic penetration testing tool, together with large language models. According to CrowdStrike, the campaign ran from late September to early October 2026 and resulted in exfiltrated data.
- CrowdStrike identified infrastructure tied to a campaign against South Korean financial organizations that resulted in exfiltrated data.
- The campaign was active from late September to early October 2026.
- The actor used ARTEX, a recently released open-source agentic pentesting tool developed in China, alongside LLMs.
- CrowdStrike assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated, but has not attributed it to a named adversary.
- Open directories exposed Claude Code session histories, ARTEX configuration files and Claude memory files.
What CrowdStrike found
CrowdStrike says its analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files and Claude memory files. According to the company, these materials gave direct insight into the actor's operational methods and tooling.
ARTEX is described by CrowdStrike as a recently released open-source agentic pentesting tool developed in China. The actor used it alongside LLMs. CrowdStrike says this use of agentic AI tooling next to traditional offensive capabilities reflects a continued evolution in adversarial tradecraft that it has observed.
The activity has not been attributed to a named adversary. CrowdStrike assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated, based on the use of the Chinese-developed ARTEX and observed Chinese-language prompts.
Reported breaches at South Korean institutions
CrowdStrike cites industry reports saying that, beginning in late September 2026, several South Korean financial organizations suffered data breaches. At one affected bank, the attacker reportedly breached a loan progress inquiry service used by financial brokers. At another, an employee mobile work-support system was compromised.
The number of affected organizations remains unconfirmed as of the writing of the post. Activity at multiple organizations purportedly involved overlapping IP addresses. Reporting also suggested the attacker used ARTEX, based on references to the string ARTEX in HTML files seen on a reportedly threat actor-controlled server.
Infrastructure analysis
CrowdStrike links the IP address 38.244.50[.]120 to the activity. It hosted an ARTEX instance and an open directory containing a Claude Code markdown document at http[:]//38.244.50[.]120:18899/.claude/CLAUDE.md.
That document held a Chinese-language pentesting prompt specifying how the LLM should carry out pentesting activities. A threat actor-controlled Hong Kong-based IP address also appeared in it. Analysis of that address revealed further open directories with Claude Code session histories, ARTEX configuration files and Claude memory files. CrowdStrike says these files indicate that from late September to early October 2026 the actor targeted South Korean financial organizations.
What it means
The findings show how openly available agentic pentesting tools, combined with LLMs, are appearing in real intrusions against financial targets. They also show that misconfigured attacker infrastructure, such as exposed open directories, can give defenders a view into prompts, session histories and configuration files. The source text available for this report is cut off, so further technical details and any defensive guidance from CrowdStrike are not covered here.
CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
