South Korea – October 12, 2026 -- CrowdStrike Intelligence has linked a late-September to early-October 2026 campaign against South Korean financial organizations, which resulted in exfiltrated data, to attacker servers that exposed Claude Code session histories, ARTEX configuration files and Claude memory files.
The actor used ARTEX, a recently released open-source agentic penetration testing tool developed in China, alongside large language models (LLMs). CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated, based on the tool choice and Chinese-language prompts. The activity has not been attributed to a named adversary.
Two banks reportedly breached through broker and employee systems
Industry reports cited by CrowdStrike say several South Korean financial organizations suffered data breaches from late September 2026. At one bank, the attacker reportedly breached a loan progress inquiry service used by financial brokers. At another, an employee mobile work-support system was compromised. The number of affected organizations remains unconfirmed, and activity at multiple victims reportedly involved overlapping IP addresses.
Open directory on 38.244.50[.]120 exposed a Chinese-language pentesting prompt
The IP address 38.244.50[.]120 hosted an ARTEX instance and an open directory containing a Claude Code markdown file. That file held a Chinese-language prompt specifying how the LLM should conduct pentesting, and it referenced a threat actor-controlled Hong Kong-based IP address. Analysis of the Hong Kong address uncovered further open directories with session histories, configuration files and memory files. The targets match the organizations named in industry reporting.
Actor ran a two-server setup with DeepSeek as primary model
The Claude Code sessions show the Hong Kong address serving as primary attacker infrastructure, while 38.244.50[.]120 hosted the ARTEX instance likely responsible for the Korean attacks. ARTEX used DeepSeek v4.1-flash as its primary LLM backend. The actor added GLM-5.3 from Zhipu AI and Grok 4.6 for additional Claude Code sessions. CrowdStrike says DeepSeek access likely ran through xcai[.]pro, a probable LLM API proxy or reseller. Nine further proxy IP addresses appeared in the sessions during the ARTEX-related activity.
Actor queried Claude on where to sell Korean breach data
Beyond the intrusions, the actor asked Claude where threat actors typically sell Korean data breach information and requested help finding Korean Telegram data-sales groups. In a separate session, the user had Claude draft a security researcher résumé with bullet points describing the ARTEX results. The prompt carried personal details, including an age, a university and a location in Guangdong, China. The same Telegram username appeared in sessions probing a Telegram-based NFT gift marketplace and in an unrelated campaign against a possible Chinese payment platform. CrowdStrike says the information available cannot definitively tie those details to the actor.
CrowdStrike expects faster intrusion tempo as adversaries adopt AI tooling
CrowdStrike concludes that AI tooling let a financially motivated actor conduct multiple intrusions within a short time span. It assesses that adversaries will likely keep experimenting with AI tooling to raise operational tempo and capabilities.