CrowdStrike Tracks ARTEX AI Pentesting Tool Used With DeepSeek and Grok to Breach Korean Banks

CrowdStrike Intelligence has uncovered an active, financially motivated cyberattack campaign that weaponized an open-source multi-agent AI penetration-testing framework named ARTEX—backed by DeepSeek v4.1-flash, Z.ai’s GLM-5.3, and xAI’s Grok 4.6—to breach and exfiltrate sensitive data from multiple South Korean financial institutions, including Shinhan Bank and Yegaram Savings Bank.

Active from late September through early October 2026, the campaign marks one of the clearest documented cases of real-world threat actors combining autonomous multi-agent pentesting harnesses with commercial and open-weight large language models to breach regulated financial networks at scale. The breaches prompted an emergency joint consumer advisory from South Korea’s Financial Services Commission (FSC) and Financial Supervisory Service (FSS), warning bank customers to guard against targeted phishing and fraudulent loan schemes built from the stolen financial records.

CrowdStrike investigators reconstructed the attacker’s exact operational workflow after discovering a misconfigured set of open directories hosted on a Hong Kong-based backbone server. Those exposed directories contained the threat actor’s live Claude Code session histories, persistent Claude memory files, and ARTEX configuration manifests pointing to a secondary attack server at IP address 38.244.50.120.

Forensic analysis of the recovered configuration files revealed how the attacker orchestrated multiple frontier and fast-inference models inside a single offensive pipeline. On the 38.244.50.120 attack host, the ARTEX multi-agent pentesting system used DeepSeek v4.1-flash as its primary high-speed reasoning backend—routed through the third-party LLM API reseller xcai.pro to obscure attribution—while calling Z.ai’s GLM-5.3 and SpaceXAI’s Grok 4.6 as supplementary specialist models. Meanwhile, the operator used Anthropic’s Claude Code locally to manage infrastructure, research vulnerabilities on a Telegram NFT gift marketplace, and even prompt Claude for advice on where cybercriminals sell stolen Korean financial datasets and how to locate Korean Telegram data-broker channels.

As reported in The Hacker News breakdown of CrowdStrike’s ARTEX investigation, the fallout was immediate: following the public disclosure of the Shinhan Bank and Yegaram Savings Bank breaches, ARTEX’s China-based creator (Autumn-27) pulled the open-source repository offline and transitioned ARTEX to closed-source distribution, stating that malicious attacks against financial institutions violated the research tool’s intended educational purpose.

Anatomy of the ARTEX Multi-Model Financial Attack Stack

Why Grey-Market LLM API Resellers Are the New Bulletproof Hosting

A critical strategic takeaway from CrowdStrike’s ARTEX report is how the threat actor bypassed model-provider safety monitoring. Even when frontier AI labs invest heavily in detecting and banning accounts that run automated cyberattacks, the operator behind the South Korean bank intrusions did not connect ARTEX directly to official first-party API endpoints with a corporate credit card. Instead, the attacker routed DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 calls through xcai.pro, a third-party API aggregator/reseller.

Just as cybercriminals have relied on bulletproof VPS hosting for two decades, grey-market LLM API resellers now allow autonomous attack frameworks like ARTEX to cycle across cheap, high-throughput models (like DeepSeek v4.1-flash) without triggering centralized abuse bans—while the human operator uses a separate tool like Claude Code for ad-hoc coding and monetizing stolen data.

The 4-Step Enterprise Implementation Playbook

1. Block Known Command-and-Control IPs and Inspect Logs for Multi-Agent Scanning: Immediately add 38.244.50.120 to your perimeter firewall and SIEM blocklists, and hunt across WAF and VPN logs from September–October 2026 for rapid, state-aware vulnerability probing characteristic of ARTEX multi-agent loops.
2. Tune WAFs for High-Velocity, Context-Aware Agentic Reconnaissance: Unlike legacy vulnerability scanners (like Nessus or Nikto) that fire static signature lists in predictable order, LLM-driven tools like ARTEX dynamically mutate payloads based on HTTP error responses; deploy behavioral rate-limiting that throttles IPs or sessions triggering sequential 4xx/5xx parser errors.
3. Never Expose .claude Memory Files or Agent Session Directories on Jump Boxes: The entire ARTEX operation was unraveled because the operator left Claude Code session histories and memory files in an open web directory; on your own red-team and DevOps servers, enforce strict 0600 file permissions on ~/.claude/, ~/.codex/, and agent config files and block dotfile serving at the web server level.
4. Harden Financial Customer Verification Against Post-Breach AI Phishing: Following the FSC and FSS warnings for Shinhan Bank and Yegaram Savings Bank customers, financial institutions should assume stolen PII will be fed directly into LLM phishing generators and require out-of-band cryptographic or app-based verification for loan and wire modifications.