# CrowdStrike Tracks ARTEX AI Pentesting Tool Used With DeepSeek and Grok to Breach Korean Banks

CrowdStrike Intelligence has uncovered an active, financially motivated cyberattack campaign that weaponized an open-source multi-agent AI penetration-testing framework named ARTEX—backed by DeepSeek v4.1-flash, Z.ai's GLM-5.3, and xAI's Grok 4.6—to breach and exfiltrate sensitive data from multiple South Korean financial institutions, including Shinhan Bank and Yegaram Savings Bank.

Active from late September through early October 2026, the campaign marks one of the clearest documented cases of real-world threat actors combining autonomous multi-agent pentesting harnesses with commercial and open-weight large language models to breach regulated financial networks at scale. The breaches prompted an emergency joint consumer advisory from South Korea's Financial Services Commission (FSC) and Financial Supervisory Service (FSS), warning bank customers to guard against targeted phishing and fraudulent loan schemes built from the stolen financial records.

CrowdStrike investigators reconstructed the attacker's exact operational workflow after discovering a misconfigured set of open directories hosted on a Hong Kong-based backbone server. Those exposed directories contained the threat actor's live Claude Code session histories, persistent Claude memory files, and ARTEX configuration manifests pointing to a secondary attack server at IP address `38.244.50.120`.

Forensic analysis of the recovered configuration files revealed how the attacker orchestrated multiple frontier and fast-inference models inside a single offensive pipeline. On the `38.244.50.120` attack host, the ARTEX multi-agent pentesting system used DeepSeek v4.1-flash as its primary high-speed reasoning backend—routed through the third-party LLM API reseller `xcai.pro` to obscure attribution—while calling Z.ai's GLM-5.3 and SpaceXAI's Grok 4.6 as supplementary specialist models. Meanwhile, the operator used Anthropic's Claude Code locally to manage infrastructure, research vulnerabilities on a Telegram NFT gift marketplace, and even prompt Claude for advice on where cybercriminals sell stolen Korean financial datasets and how to locate Korean Telegram data-broker channels.

As reported in [The Hacker News breakdown of CrowdStrike's ARTEX investigation](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html), the fallout was immediate: following the public disclosure of the Shinhan Bank and Yegaram Savings Bank breaches, ARTEX's China-based creator (`Autumn-27`) pulled the open-source repository offline and transitioned ARTEX to closed-source distribution, stating that malicious attacks against financial institutions violated the research tool's intended educational purpose.

<a aria-hidden="true" id="executive-fast-facts"></a>  Fast Facts

- **Threat Intelligence Source**: Disclosed by CrowdStrike Intelligence following forensic analysis of exposed Hong Kong server directories; corroborated by alerts from South Korea's Financial Services Commission (FSC) and Financial Supervisory Service (FSS).
- **Targeted Financial Victims**: Multiple South Korean financial institutions breached between late September and early October 2026, including Shinhan Bank and Yegaram Savings Bank.
- **Offensive AI Stack**: ARTEX multi-agent autonomous penetration testing framework (created by `Autumn-27`), hosted on `38.244.50.120` and paired with Claude Code operational sessions on a Hong Kong backbone IP.
- **Multi-Model Routing**: Primary LLM backend powered by DeepSeek v4.1-flash (accessed via API reseller `xcai.pro`), supplemented by Z.ai GLM-5.3 and xAI Grok 4.6.
- **Tool Fallout**: Developer `Autumn-27` immediately closed-sourced ARTEX after the Korean banking breaches were exposed.

## Anatomy of the ARTEX Multi-Model Financial Attack Stack

| Infrastructure / Component | Specific Technology / Identifier | Role in the South Korean Banking Campaign | Forensic Discovery Vector |
|---|---|---|---|
| **Autonomous Pentest Engine** | ARTEX (by `Autumn-27`, now closed-source) | Multi-agent reconnaissance, vulnerability probing, and data exfiltration | Exposed ARTEX config files on Hong Kong server |
| **Primary Attack Host** | IP `38.244.50.120` | Executed automated ARTEX scans against Shinhan Bank &amp; Yegaram Savings Bank | Linked via Hong Kong backbone server logs |
| **Primary &amp; Secondary LLMs** | DeepSeek v4.1-flash + GLM-5.3 + Grok 4.6 | High-speed exploit reasoning and multi-agent task execution | API keys and model routing found in ARTEX config |
| **API Anonymization Layer** | `xcai.pro` LLM API Reseller | Proxied DeepSeek v4.1-flash API calls without direct KYC billing | Endpoint URLs hardcoded in ARTEX settings |
| **Operator Command Assistant** | Anthropic Claude Code (`@YY520CN` refs) | Used by operator to manage tooling and query Korean Telegram data markets | Open directory leaked Claude Code session &amp; memory files |

## Why Grey-Market LLM API Resellers Are the New Bulletproof Hosting

A critical strategic takeaway from CrowdStrike's ARTEX report is how the threat actor bypassed model-provider safety monitoring. Even when frontier AI labs invest heavily in detecting and banning accounts that run automated cyberattacks, the operator behind the South Korean bank intrusions did not connect ARTEX directly to official first-party API endpoints with a corporate credit card. Instead, the attacker routed DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 calls through `xcai.pro`, a third-party API aggregator/reseller.

Just as cybercriminals have relied on bulletproof VPS hosting for two decades, grey-market LLM API resellers now allow autonomous attack frameworks like ARTEX to cycle across cheap, high-throughput models (like DeepSeek v4.1-flash) without triggering centralized abuse bans—while the human operator uses a separate tool like Claude Code for ad-hoc coding and monetizing stolen data.

### The 4-Step Enterprise Implementation Playbook

1. **Block Known Command-and-Control IPs and Inspect Logs for Multi-Agent Scanning**: Immediately add `38.244.50.120` to your perimeter firewall and SIEM blocklists, and hunt across WAF and VPN logs from September–October 2026 for rapid, state-aware vulnerability probing characteristic of ARTEX multi-agent loops.
2. **Tune WAFs for High-Velocity, Context-Aware Agentic Reconnaissance**: Unlike legacy vulnerability scanners (like Nessus or Nikto) that fire static signature lists in predictable order, LLM-driven tools like ARTEX dynamically mutate payloads based on HTTP error responses; deploy behavioral rate-limiting that throttles IPs or sessions triggering sequential 4xx/5xx parser errors.
3. **Never Expose `.claude` Memory Files or Agent Session Directories on Jump Boxes**: The entire ARTEX operation was unraveled because the operator left Claude Code session histories and memory files in an open web directory; on your own red-team and DevOps servers, enforce strict `0600` file permissions on `~/.claude/`, `~/.codex/`, and agent config files and block dotfile serving at the web server level.
4. **Harden Financial Customer Verification Against Post-Breach AI Phishing**: Following the FSC and FSS warnings for Shinhan Bank and Yegaram Savings Bank customers, financial institutions should assume stolen PII will be fed directly into LLM phishing generators and require out-of-band cryptographic or app-based verification for loan and wire modifications.

  Next Steps

1. Search your network telemetry and threat-intelligence feeds for any inbound connections from `38.244.50.120` or anomalous multi-agent web application probing over the past 30 days.
2. Audit internal red-team and developer workstations to ensure no AI coding agent session logs, `.env` files, or `.claude` memory directories are readable from public or staging web roots.
3. Test your perimeter WAF rules against autonomous multi-agent pentesting harnesses to verify that adaptive, LLM-mutated exploit probes trigger automated IP quarantine.