Hacker Used ARTEX AI and Claude Agents in Attacks on South Korean Banks
Summary
A Chinese-speaking hacker used ARTEX AI and Claude agents to target South Korean banks, exposing customer and credit-card data and causing outages. Researchers linked the activity to infrastructure containing AI-tool session records.
Key points
- The attacks targeted Shinhan Bank, KB Kookmin Bank, and Hana Bank.
- Customer personal data and credit-card information were exposed, and some systems experienced outages.
- CrowdStrike confirmed the use of ARTEX, an AI-powered penetration-testing suite, alongside Claude agents.
- Exposed infrastructure contained Claude Code session histories, ARTEX configuration files, and memory files.
- Researchers said the activity used DeepSeek as its primary LLM backend, with GLM and Grok used in additional sessions.
- The attacker’s identity could not be reliably confirmed from exposed personal details.
- ARTEX’s developer made the project closed-source and discontinued updates, but existing code has been used for derivatives.
Article Details
- Victim Organization
- Shinhan Bank; KB Kookmin Bank; Hana Bank
- Incident Type
- Cyberattacks and exposure of customer data
- Disclosure Date
- 2026-10-10
- Data Types Exposed
- Personal data
- Credit card information
- Operational Impact
- System outages occurred in some cases.
- Ransom Or Extortion
- The records reportedly showed no specific plan to monetize the stolen bank data. The attacker asked Claude to suggest Telegram groups for selling data focused on Korea.
- Claim Status
- confirmed
Vendors
AnthropicAnthropic asks Claude users to share voice data for AI model trainingCrowdStrikeSecurity firm CrowdStrike confirmed the use of ARTEX AI, up until recently an open-source agentic penetration testing suite developed in China.DeepSeek“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.Zhipu AI“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.
Products
ARTEX AIARTEX AI, Claude agents used in cyberattacks on South Korean banksClaudeARTEX AI, Claude agents used in cyberattacks on South Korean banksDeepSeek v4.1-flash“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.GLM-5.3“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.Grok 4.6“The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions,” CrowdStrike explained.