Chinese Hacker Uses ARTEX AI and Claude Agents to Breach South Korean Banks

Recent cyberattacks targeting major South Korean financial institutions—including Shinhan Bank, KB Kookmin Bank, and Hana Bank—have highlighted a shift toward autonomous, AI-driven tooling in threat actor operations. An unidentified Chinese-speaking attacker leveraged the ARTEX AI agentic penetration testing framework alongside Claude agents to compromise network perimeters, exfiltrate sensitive client records, and trigger system outages across multiple institutions.

The South Korean government responded to the breaches by convening an emergency meeting and issuing calls for immediate security hardening across all critical national financial infrastructure.

AI-Driven Breach Techniques and Infrastructure

Until recently, ARTEX AI was maintained as an open-source agentic penetration testing suite developed in China. Designed to automate multi-stage security testing, agentic frameworks like ARTEX allow operators to delegate tasks such as network reconnaissance, vulnerability identification, payload generation, and lateral movement to autonomous AI workers. When weaponized, these tools drastically compress the time required between initial access scanning and exploitation.

Security researchers at CrowdStrike analyzed the adversary’s command-and-control (C2) infrastructure after discovering misconfigured open web directories hosted by the attacker. These exposed directories contained:

• Claude Code session histories recording direct interactions between the attacker and AI agents.
• ARTEX configuration files detailing backend configurations and targeting modules.
• Claude memory files retaining context and operational state across distinct agent tasks.

The technical setup utilized a hybrid multi-model pipeline. ARTEX relied on DeepSeek v4.1-flash as its primary backend LLM, accessed through the API proxy and reseller domain xcai[.]pro. To supplement the main pipeline, the adversary deployed additional Claude Code sessions powered by GLM-5.3 (developed by Zhipu AI) and Grok 4.6. By combining automated offensive frameworks with multi-agent orchestration, the attacker was able to run parallelized, adaptive scanning and exploitation workflows against banking infrastructure without requiring bespoke exploit code for every step.

Operational Missteps and Attribution

Despite utilizing advanced agentic AI pipelines to conduct the breaches, the threat actor exhibited significant operational security (OpSec) failures. By deploying AI agents to assist with personal tasks, the attacker inadvertently left highly identifying materials within publicly accessible session logs and open directories.

Analysis of the exfiltrated session files revealed that the attacker asked Claude to draft a personal résumé. The generated CV contained contact details, Telegram account identifiers, and background information suggesting the individual may be a 26-year-old Chinese national who studied at the South China University of Technology and resides in Maoming, Guangdong Province, China. However, secondary records within the same files contained conflicting personal details, including a listed birth year of 2007. While these artifacts tie the activity to a specific persona, researchers note the identifiers remain unconfirmed due to potential intentional disinformation or shared infrastructure usage.

The logs also provided rare insight into the attacker’s post-exploitation decision-making. The individual lacked a concrete monetization strategy for the exfiltrated credit card records and customer personal data. Instead of utilizing established dark web breach forums or pre-arranged buyers, the operator explicitly prompted Claude to identify active South Korean data-broker groups operating on Telegram.

Following confirmation that the open-source suite had been weaponized in active bank breaches, the developer of ARTEX AI moved the code repository to closed-source status and officially discontinued further updates. However, English- and Korean-language forks and derivative projects had already been cloned and remain available across secondary repositories.

Realistic Blast Radius and Risk Assessment

For tier-1 financial institutions like Shinhan Bank, KB Kookmin Bank, and Hana Bank, the impact of an agentic breach extends far beyond initial data theft:

• Data Exposure and Regulatory Liability: The exposure of credit card details and personal identifiable information (PII) triggers severe compliance obligations under South Korean privacy laws (such as the Personal Information Protection Act), carrying substantial regulatory fines and forced remediation mandates.
• Operational Availability: System outages during active agentic attacks indicate that automated scanning or exploit execution disrupted production banking services, threatening customer transaction flows and institutional trust.
• Ecosystem Acceleration: The availability of localized ARTEX derivatives lowers the technical barrier to entry for lower-tier threat actors, allowing unsophisticated operators to launch complex, multi-model automated attacks against high-value financial perimeters.

Mitigating Agentic AI Threats

Organizations facing automated agentic attacks must move beyond standard signature-based detection to monitor for anomalous API activity and rapid automated workflows:

• Block Known Adversarial Infrastructure: Ensure network perimeters and egress filters drop traffic associated with known LLM API proxies used by threat actors, specifically including xcai[.]pro.
• Detect Agentic Reconnaissance Patterns: Agentic frameworks generate distinct web traffic profiles characterized by high-volume, adaptive path probing and dynamic user-agent variations executed within short windows. Enable strict rate-limiting and behavior-based web application firewall (WAF) rules on external banking endpoints.
• Harden Misconfigured Storage and C2 Endpoints: Threat actors frequently re-use open directory configurations. Audit all internal and external web servers for exposed index listings, open S3 buckets, or unauthenticated log repositories.
• Restrict LLM API Capabilities: Enforce strict access controls, prompt injection defenses, and strict data-loss prevention (DLP) controls around internal AI coding assistants and automation workflows to prevent accidental credential or operational log exposure.