Attack Footprint: ARTEX Instance to Client\n\nCrowdStrike's intelligence team published a 10 October 2026 blog reconstructing an agentic intrusion chain against South Korean financial institutions that ran from late September into early October. [^cs] Targets included at least Shinhan Bank, KB Kookmin Bank and Hana Bank. At one victim, the attacker breached a loan-progress inquiry service used by financial brokers; at another, an employee mobile work-support system was compromised. Overlapping IP addresses across victims tied the activity to a single operator.\n\nThe agentic penetration testing tool ARTEX — developed in China by Autumn-27 and described by CrowdStrike as "a recently released Chinese-developed open-source agentic penetration testing tool" — sat at the center of the chain. [^thn] ARTEX positions itself as an LLM multi-agent-driven autonomous pentest system; once wired to a model, it splits a target into recon, exploitation, and lateral-movement phases.\n\n## Model Stack: Four Vendors, One Proxy\n\nClaude Code session histories, ARTEX configuration files and Claude memory files left on the operator-controlled open directories gave CrowdStrike a direct view of the model mix. The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, complemented by additional Claude Code sessions routed through a Hong Kong-based IP. Some sessions ran Zhipu AI's GLM-5.3 and xAI's Grok 4.6. LLM traffic flowed through the proxy xcai[.]pro — meaning audit logs see the proxy edge rather than the official DeepSeek domain. The core ARTEX instance sat at 38.244.50.120 with nine rotating proxy addresses.\n\n## The Operator's Own Alarm Bell\n\nThe most quotable detail sits inside the Claude Code session history. The attacker asked Claude to draft a security researcher résumé that included bullet points summarizing the ARTEX-related activity — and pasted these personal details into the same prompt: name YY, phone 17820191556, Telegram @YY520CN, age 26, South China University of Technology, Maoming Guangdong.\n\nBecause Claude Code persists session context, and because the operator left the open directory at port 18899 of 38.244.50.120 publicly exposed, anyone who reached that host — including CrowdStrike — could read the prompt verbatim. CrowdStrike stresses that while these details likely belong to the operator, they cannot prove attribution from a single artefact.\n\nThe same Telegram handle YY520CN was also used in vulnerability research against a Telegram-based NFT gift marketplace, and an unknown threat actor using that handle had previously targeted a Chinese payment platform.\n\n## MITRE ATT&CK Reading\n\nCrowdStrike's tactic breakdown fits a classic resource-development plus command-and-control shape. T1583.003 maps to bulk-acquiring VPS nodes; T1588.007 maps to deploying the open-source ARTEX tool; T1090 maps to nine-address rotation. This tagging vindicates MITRE's 2025 addition of the AI sub-technique under T1588: the LLM itself is now a procured attack capability.\n\n## Why It Matters\n\nTwo questions surface from this incident — one for offense, one for defense.\n\nOn offense, ARTEX-class tools collapse the marginal cost of capability to the level of an individual. Someone with a pentest idea who cannot write a modular scanner can now pair natural language with a few open-source libraries and replicate in two weeks what a red team would have taken a quarter to prepare. There is no need for an ongoing service — this is the new normal of "general enough models, ready-made agents."\n\nOn defense, the takeaway is direct: a Claude Code session history is a complete crime notebook. Asking the model to draft a résumé exposes the answer to the public web when the open directory is left exposed. For enterprises, this means treating AI-coding-tool local caches, CLAUDE.md prompt files and externally reachable dev sandboxes with the same hygiene as source code: classify them as sensitive, log access, scan them for accidental PII before they are shared.\n\nSouth Korea was not an isolated case. Anthropic's September report counted Claude threats-to-harm conversations forwarded to law enforcement as a recurring category; CrowdStrike itself published an LLM-generated PhantomRaven infostealer in September. The clear trend is that the productivity property of AI tools is letting amateur operators cross into persistent intrusion territory while leaving trails that are easier, not harder, to read.\n\n---\n\nReferences\n[^cs]: CrowdStrike, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, 2026-10-07. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/\n[^thn]: The Hacker News, ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms, 2026-10-08. https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html