Threat Actor Uses ARTEX Framework to Target South Korean Financial Firms, Stealing Data of 67,000 People
Summary
A campaign using the ARTEX agentic penetration-testing framework targeted South Korean financial firms, exploiting internet-facing applications and exfiltrating personal information belonging to about 67,000 people.
Key points
- The campaign was first observed in late September 2026 and affected multiple South Korean financial firms.
- The actor exploited internet-facing customer inquiry portals and employee mobile-app backends.
- The campaign exfiltrated personally identifiable information belonging to approximately 67,000 individuals.
- ThreatLabz assesses with moderate confidence that the actor is financially motivated and Chinese-speaking.
- ARTEX is an open-source agentic penetration-testing framework that uses large language models to automate reconnaissance and exploitation tasks.
- Zscaler reports detecting campaign indicators under the threat name HTML.MalURL.Gen.LZ.
Article Details
- Incident Type
- Exploitation campaign targeting internet-facing web applications at South Korean financial institutions, using the ARTEX agentic penetration testing framework
- Data Types Exposed
- Personally identifiable information (PII)
- Affected Records
- Approximately 67,000 individuals
- Operational Impact
- PII belonging to approximately 67,000 individuals was exfiltrated. The source does not report other operational disruption.
- Claim Status
- confirmed