ARTEX AI, Claude agents used in cyberattacks on South Korean banks

A Chinese-speaking threat actor used the ARTEX AI penetration testing framework and Anthropic's Claude AI agents to conduct cyberattacks against major South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks led to exposure of customers' personal and financial data, as well as system outages. Infrastructure analysis revealed open directories containing ARTEX configuration files, Claude session histories, and memory files, which exposed the attacker's methods and partial identity. The actor used multiple LLMs, including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, accessed via the API proxy xcai[.]pro, and showed interest in monetizing stolen data through Telegram.

AI-extracted · verify before operational use