CrowdStrike: Suspected Chinese-Speaking Hacker Used ARTEX AI Agent in South Korean Bank Breaches

CrowdStrike says an unidentified attacker, likely a Chinese speaker, used ARTEX, a recently released open-source agentic penetration testing tool developed in China, alongside large language models in a campaign against South Korean financial organizations that ended in exfiltrated data. The campaign was active from late September to early October 2026, according to CrowdStrike.

Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told reporters on a call Thursday that the incident exemplified a human adversary using AI agents to conduct widespread attacks. Note the framing: the human is the subject, the agent is the instrument. That is the claim worth testing.

What CrowdStrike says it found

The evidence comes from the attacker's own mess. CrowdStrike says threat actor-controlled open directories held Claude Code session histories, ARTEX configuration files and Claude memory files, which it describes as direct insight into the actor's methodology and tooling.

The sessions reveal a two-server setup, per CrowdStrike: a Hong Kong-based IP address as primary infrastructure, and a second address hosting the ARTEX instance likely responsible for the Korean attacks. That instance used DeepSeek v4.1-flash as its primary model backend, supplemented by GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions. CrowdStrike says DeepSeek was likely accessed through an API proxy or reseller, xcai[.]pro, and lists nine proxy IP addresses seen in the activity.

The entry points were not vault doors. At one bank the attacker reportedly breached a loan progress inquiry service used by brokers. At another, an employee mobile work-support system was compromised.

The attacker also asked Claude where threat actors typically sell Korean data breach information and for help finding Korean Telegram data sales groups. Separately, the attacker asked Claude to write a security researcher resume highlighting ARTEX activity, supplying a name, an age, a university and a location in Guangdong, China. According to iTnews, a man who answered the phone number in CrowdStrike's report said he had no knowledge of the matter. Whether those details are real or planted is an open question.

The numbers do not agree

CrowdStrike assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated, based on the Chinese-developed tool and observed Chinese-language prompts. It does not attribute the activity to a named adversary. That is thinner than "China-based," the phrase some headlines used, and the distinction matters.

The victim count is where the sources part ways:

• The Wall Street Journal reported that officials said personal information of 68,000 people was stolen across at least seven South Korean financial firms.
• The Kyunghyang Shinmun, citing financial authorities and industry, itemized 25,727 records at Shinhan Bank (names, contact details, annual income, loan limits), 119 at KB Kookmin Bank, 89 at Hana Bank and more than 2,200 corporate records at Welcome Savings Bank. That adds up to roughly 28,000.
• Reuters and iTnews report at least nine banks disclosed or were reported as targeted. CrowdStrike says the total number of affected organizations is unconfirmed.

The Kyunghyang Shinmun lists intrusions between September 27 and 30 at Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram Savings Bank, Hyundai Capital and Welcome Savings Bank, plus two P2P lenders. Nobody in this material reconciles 28,000 with 68,000. Treat both as provisional.

There is a second disagreement, about intent. CrowdStrike calls it a targeted campaign. South Korean financial authorities view it as an automated, randomized brute-force attack that tested many institutions and got through weaker peripheral systems. Those are different stories, and an agent that sprays widely would fit the second one fine.

A two-month-old tool with a disclaimer

The Kyunghyang Shinmun, citing GitHub records, says ARTEX was released July 26. On September 3 it took first place among about 150 teams at a cyber offense-defense competition hosted by Baidu. Its latest version came out September 24, and three days later the attack on Kookmin Bank began. Moon Jong-hyun, head of the Genians Security Center, wrote on October 2 that the HTML title of web servers used in the attacks contained the string "ARTEX-自主渗透試控制台(autonomous penetration test console)."

The tool's GitHub page, per iTnews, says it is intended for personal learning, code research and local technical verification, and should not be used for real-world testing against online systems or websites. The repository says it was published by a Chinese security engineer using the handle Autumn / Autumn-27. A disclaimer is a sentence, not a control.

The response was fast. The Financial Services Commission held an emergency inspection meeting across the financial sector on October 4, chaired by Chairman Lee Ok-won, and President Lee Jae Myung called for a thorough investigation. Park Sang-won, president of the Financial Security Institute, said the attack IPs were almost the same for the banks and a bit different for the savings banks, with IPs from eight countries reportedly used.

This follows an Australian statement last month that an OpenAI autonomous agent breached a government health statistics portal in June.

What it means, and what to watch

What the account does not give us is a measurement. Nothing here quantifies how much of the intrusion work the agent performed versus the human operator, how often it failed, or how a given model backend changed the results. The session files make a strong exhibit, but an exhibit is not an eval.

Watch for five things:

• The actor's identity, and whether the resume details are genuine or spoofed.
• Whether the stolen data was sold or distributed through Telegram or other underground forums.
• A reconciled count of victims and institutions.
• Any findings from Anthropic, China's Ministry of Foreign Affairs or South Korean police, none of which appear in the current reporting.
• Whether the targeted-versus-randomized dispute gets settled with evidence.