Two Weeks, Several Banks, One AI Hacking Agent: Inside the ARTEX Campaign Against South Korean Finance

From late September to early October 2026, an unidentified attacker broke into several South Korean financial institutions and took data, according to CrowdStrike Intelligence. At one bank, the attacker reportedly got into a loan-status service used by brokers. At another, it was an employee mobile work system. The number of victims is still unconfirmed.

The attacker didn't do most of the work by hand. They ran ARTEX, a newly released open-source AI agent built in China for penetration testing, with DeepSeek as its main brain. They also ran Claude Code sessions, some powered by Zhipu's GLM and xAI's Grok. CrowdStrike found the evidence on the attacker's own servers, which had been left publicly exposed: Claude Code session logs, ARTEX settings files, and a Chinese-language instruction file telling the AI how to run the attack. In the same sessions, the attacker asked Claude where stolen Korean bank data usually gets sold and how to find Telegram groups that buy it.

CrowdStrike's conclusion: AI tooling let one financially motivated operator run multiple intrusions in a short time. A tool built to test defenses was used for real attacks, with several commercial AI models doing the work.

The report doesn't mention any AI provider catching it. The campaign came to light because the attacker left their own files open to the internet. CrowdStrike has not named the attacker and describes them only as likely Chinese-speaking, with moderate confidence.