CrowdStrike Intelligence has tied a wave of intrusions against South Korean financial institutions to a suspected lone, Chinese-speaking, financially motivated actor who weaponised AI tooling: ARTEX, an open-source agentic penetration-testing suite developed in China, run alongside Claude Code with LLM backends including DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6. Activity ran from late September into early October against Shinhan Bank, KB Kookmin Bank and Hana Bank as well as savings banks, capital firms and online lenders, exposing clients' personal data and credit-card information and causing outages in some cases; Seoul's government convened an emergency meeting and demanded immediate security measures for critical IT systems. Open directories on the attacker's servers exposed Claude Code session histories and ARTEX configurations, letting researchers reconstruct the intrusions — including the actor asking Claude where stolen Korean data is sold. Korean media reports put Shinhan's exposed customer records at roughly 25,000 and KB Kookmin's at 119, counts not confirmed by the banks. ARTEX's developer has taken the project closed-source.

• Source article