The ARTEX South Korean bank breach

CrowdStrike and South Korean investigators have documented an attack on at least seven South Korean financial firms using ARTEX, a Chinese open-source agentic pentesting tool, with personal data on 68,000 people compromised. The attacker is believed to be a student at South China University of Technology. ARTEX was created by Chinese cybersecurity engineer Li Puhua, also known as 'Autumn', and has been freely downloadable on GitHub since July; it won a Baidu-hosted attack-and-defense competition in September. The attacker's stack included ARTEX running on DeepSeek v4.1-Flash via an API reseller, along with GLM-5.3, Grok 4.6, and Claude Code. CrowdStrike identified an ARTEX instance at IP address 38.244.50[.]120 port 18899, which hosted an open directory containing a CLAUDE.md file with a Chinese-language pentesting prompt specifying how the LLM should conduct penetration testing. A Hong Kong-based IP address appeared within that configuration document. Investigators identified ARTEX's involvement by finding its HTML tag signature in command-and-control server headers. The attacker was caught due to operational failures: they left directory listing enabled on their server, exposing Claude Code session histories, Claude memory files, and ARTEX configurations. Within those sessions, the attacker had asked Claude to add the bank hack to their résumé, providing investigators with personal information, and had also queried Claude about where stolen South Korean data could be sold. South Korean cybersecurity firm Genians' security center head Moon Jong-hyun publicly disclosed the findings on LinkedIn.