CrowdStrike Details ARTEX-Enabled Attacks on South Korean Financial Organizations
Summary
CrowdStrike linked infrastructure and Claude Code artifacts to a late September–early October 2026 campaign targeting South Korean financial organizations, where data was reportedly exfiltrated using ARTEX and LLMs.
Key points
- The campaign targeted South Korean financial organizations from late September to early October 2026; the number of affected organizations remains unconfirmed.
- Industry reporting described breaches at a bank's loan inquiry service and another bank's employee mobile work-support system, with data exfiltration reported.
- Open directories exposed Claude Code session histories, ARTEX configuration files, and memory files that provided insight into the operator's activity.
- The analysis describes a two-server setup, with a Hong Kong-based server as primary infrastructure and 38.244.50[.]120 hosting an ARTEX instance.
- The ARTEX instance used DeepSeek v4.1-flash, with GLM-5.3 and Grok 4.6 also used in other Claude Code sessions.
- The actor is unattributed; CrowdStrike assesses with moderate confidence that the operator is likely Chinese-speaking and financially motivated.
Article Details
- Attack Vectors
- The threat actor used ARTEX with large language models to conduct intrusions against South Korean financial organizations.
- At one affected bank, the actor reportedly breached a loan progress inquiry service used by financial brokers.
- At another bank, the actor reportedly compromised an employee mobile work-support system.
- The activity resulted in data exfiltration, according to CrowdStrike Intelligence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 101[.]53[.]80[.]20 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 103[.]248[.]148[.]84 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 124[.]155[.]252[.]63 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 154[.]201[.]79[.]246 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 203[.]160[.]133[.]172 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 205[.]214[.]59[.]31 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 209[.]209[.]85[.]38 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 23[.]158[.]220[.]98 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 23[.]248[.]249[.]90 | Proxy IP address used during ARTEX-related activity. |
| IPV4 | 38[.]244[.]50[.]120 | Threat actor-controlled IP address hosting an ARTEX instance and an open directory. |
| URL | hxxp[:]//38[.]244[.]50[.]120:18899/[.]claude/CLAUDE[.]md | Document URL on the threat actor-controlled host containing a pentesting prompt. |
MITRE ATT&CK
T1090 · ProxyThe actor used multiple proxy IP addresses during ARTEX-related activity.T1583.003 · Virtual Private ServerThe report states that the threat actor acquired infrastructure at multiple IP addresses for command-and-control operations.T1588.007 · Artificial IntelligenceThe report identifies the actor's obtaining and deploying ARTEX, an AI-driven penetration testing tool, for attacks against South Korean financial organizations.
People
Vendors
Products
Claude CodeAnalysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodologyDeepSeek v4.1-flashThe ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.GLM-5.3The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.Grok 4.6The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.
Tools
ARTEXAnalysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodologyClaude CodeAnalysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology