Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.

The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration.

"In this activity, the threat actor leveraged ARTEX, a recently released open-source agentic penetration testing (pentesting) tool developed in China, alongside large language models (LLMs)," the cybersecurity company said.

CrowdStrike said it discovered the campaign after it identified a set of open directories hosted at a Hong Kong-based IP address, exposing Claude Code session histories, Claude memory files, and ARTEX configuration files.

The campaign has not been attributed to any known threat actor or group. But evidence points to a suspected Chinese-speaking operator driven by financial gain.

ARTEX is a large language model (LLM) multi-agent-driven autonomous penetration system developed by Autumn-27. Analysis of the Claude Code sessions from the Hong Kong IP address has revealed a two-server architecture -

The ARTEX instance has been found to use DeepSeek v4.1-flash as the main LLM backend, while using Z.ai's GLM-5.3 and SpaceXAI's Grok 4.6 to supplement the model. It's suspected that the threat actor accessed DeepSeek via the likely LLM API reseller "xcai[.]pro."

"In addition to conducting ARTEX-related operations, the threat actor asked Claude where threat actors typically sell Korean data breach information and asked Claude for assistance in finding Korean Telegram data sales groups," CrowdStrike said.

" Other sessions related to vulnerability research on a Telegram-based NFT gift marketplace have also used the same Telegram username.

Source link