South Korea's Financial Services Commission discloses 16 financial firms breached by open-source AI pen-testing tool ARTEX, ~100,000 records exposed
CrowdStrike traced the campaign to a suspected 26-year-old individual in Guangdong using the domestic open-source AI pen-testing tool ARTEX that calls DeepSeek V4.1 Flash and other models.
On October 14, South Korea's Financial Services Commission disclosed that 16 financial firms — including Shinhan, KB Kookmin, Hana, and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital — had been breached in AI-enabled attacks since early October, exposing approximately 100,000 records containing names, incomes, loan limits, and in some cases national ID numbers. Police deployed 28 cyber-terrorism investigators in four teams; the President ordered a full investigation.
CrowdStrike's investigation traced the campaign through exposed directories containing ARTEX configuration files and Claude Code session logs, leading to a suspected 26-year-old individual based in Guangdong province. The attacker's setup ran DeepSeek V4.1 Flash as the primary engine, with Zhipu GLM-5.3 and xAI Grok 4.6 layered in for supplementary sessions. The Claude Code logs were not used for intrusion but captured the attacker asking Claude about channels to sell stolen South Korean data, finding data-breach Telegram groups, and even drafting a fake security researcher resume with invented credentials.
ARTEX is an open-source AI penetration-testing agent posted to GitHub on July 26 by a Chinese security engineer. It uses a multi-agent architecture that identifies targets, finds vulnerabilities, plans attack paths, and self-verifies results, originally under AGPL. Its creator Autumn-27 pulled the tool from GitHub on October 8 citing misuse, days after nine South Korean banks were hit. Attacks bypassed weakly protected peripheral platforms (loan agent portals, mobile employee support, sales support systems) rather than core ledgers.
The financial sector said no bank account numbers or card numbers directly usable for illicit payment have been found in the leaked data. Japan's Kyodo News reported that corporate data breaches in Japan have risen sharply since September, possibly using advanced AI to launch indiscriminate attacks on vulnerable systems; Japan's government has asked corporate and local government leaders to lead strengthening responses.