AI Pentesting Tool ARTEX Turned Against South Korean Financial Firms in Data Theft Campaign

CrowdStrike Intelligence has detailed a targeted campaign against South Korean financial organisations that ran from late September to early October 2026 and resulted in data theft. The attacker used ARTEX, a recently released open-source, AI-driven penetration testing tool developed in China, together with large language models (LLMs).

CrowdStrike found the campaign after spotting open directories on a Hong Kong-based IP address. These exposed Claude Code session histories, Claude memory files and ARTEX configuration files. ARTEX is a multi-agent system that runs penetration tests autonomously. In this case it mainly used DeepSeek as its language model, supported by Z.ai's GLM and SpaceXAI's Grok. The operator is suspected to have reached DeepSeek through an LLM API reseller. The sessions also showed the operator asking Claude where Korean data breach information is typically sold and for help finding Korean Telegram data sales groups.

The campaign has not been linked to any known threat actor, though the evidence points to a suspected Chinese-speaking operator motivated by money. One prompt referenced a Telegram username, but CrowdStrike said the available information cannot definitively tie those details to the attacker. ARTEX's developer, Autumn-27, has since taken the tool closed source and said the attacks had nothing to do with them and go against the tool's purpose.