CrowdStrike Traces South Korean Bank Breaches to ARTEX, LLM Toolkit
Image
South Korea – October 12, 2026 -- CrowdStrike Intelligence has linked a late-September to early-October 2026 campaign against South Korean financial organizations, which resulted in exfiltrated data, to attacker servers that exposed Claude Code session histories, ARTEX configuration files and Claude memory files.
The actor used ARTEX, a recently released open-source agentic penetration testing tool developed in China, alongside large language models (LLMs). CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated, based on the tool choice and Chinese-language prompts. The activity has not been attributed to a named adversary.