ARTEX Breached Seven South Korean Banks; Developer Pulls Tool From GitHub

ARTEX, a Chinese-developed open-source AI penetration-testing agent, was used to breach at least seven South Korean financial firms, stealing personal data from 68,000 people, according to the Wall Street Journal. South Korea's National Police Agency cyber terror unit opened a formal investigation. In Japan, a GMO affiliate's investigation found attack infrastructure targeting approximately 20 companies, almost all in Japan, with nine working in the same industry. The operator behind the South Korean campaign ran attacks against financial institutions from late September to early October 2026, using DeepSeek v4.1-flash as the underlying model. CrowdStrike discovered the campaign by identifying open directories at a Hong Kong-based IP address containing Claude Code session histories, Claude memory files, and ARTEX configuration files, and assessed with moderate confidence that the operator is Chinese-speaking and financially motivated, based on Chinese-language prompts and use of the China-developed tool. After the breaches became public, the developer using the handle Autumn-27, identified by the WSJ as Li Puhua, pulled ARTEX from GitHub and announced the tool would cease updates and go closed-source, stating it was originally built for learning and research. ARTEX is a multi-agent system capable of calling multiple LLMs including Claude, ChatGPT, and DeepSeek, published in late July 2026 under an AGPL-3.0 licence.