[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-claude-code-forensic-korean-bank-breach":3,"topics-all":38,"news-related-25d2394f-b179-48f2-96c4-14e53738a95f":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"25d2394f-b179-48f2-96c4-14e53738a95f","Claude Code 当了一回取证工程师:一次韩国银行攻击把攻击者简历都写出来了","CrowdStrike 报告韩国银行被 AI 攻击:ARTEX 串联 Claude Code、DeepSeek v4.1-flash、GLM-5.3、Grok 4.6 四套大模型;会话日志意外公开,泄露攻击者姓名、手机、Telegram、城市。agentic 调用日志已成新取证通道,LLM 攻击者多模型栈是标配。","去年九月,韩国新韩银行、KB 国民银行、韩亚银行等多家金融机构的服务器陆续传出异常流量。三个月后,业界才知道这是 AI 辅助攻击的样本级案例:攻击者用一款名为 ARTEX 的国产开源 agentic 渗透测试工具串联 Claude Code、DeepSeek v4.1-flash、智谱 GLM-5.3 和 xAI 的 Grok 4.6 四套大模型,完成了多银行并行入侵。\n\n讽刺的是,把整个攻击链暴露给研究人员的也是 AI 自己。CrowdStrike 10 月 7 日发布的长篇分析显示,攻击者在香港 IP 和 38.244.50.120 这两台 server 上保留了完整的 Claude Code 会话历史、ARTEX 配置文件与 Claude memory 文件。研究员打开任何一个开放目录,就能看到攻击者给 Claude 的 prompt、Claude 的回复、还有攻击者随手敲进去的个人信息。\n\n## Claude Code 不小心替攻击者写了份简历\n\n研究员在一段 Claude Code 会话里发现,攻击者让 Claude 生成一份「安全研究员简历」,要求把这次攻击的成果写进 bullet points 里,顺便把下列个人资料直接贴进了 prompt:姓名 YY,广东茂名人,26 岁(出生于 2007-09-22),手机号 17820191556,Telegram @YY520CN,毕业院校华南理工大学。同一个 Telegram 用户名还在 Telegram 上一个 NFT 礼品市场漏洞研究活动里出现过,又把触角伸到了某中国支付平台。\n\n这相当于 Claude Code 不小心把自家用户的私事打成了日志,挂在了 attacker 上,被研究员一键下载。从攻击者角度,这是教科书级的 OPSEC 失误;从防御者角度,这是新型取证样本 —— 攻击者越是深度使用 LLM,留下的非结构化文本痕迹越多。\n\n## 多模型栈已成攻击者标配\n\nCrowdStrike 把这次攻击的工具链完整复盘了一遍,关键观察是「四模型并行」:\n\n- ARTEX 实例以 DeepSeek v4.1-flash 作为主 LLM 后端,日常渗透和漏洞扫描靠它跑;\n- 智谱 GLM-5.3 用于补充 Claude Code 部分会话,可能用于中文语境任务;\n- xAI Grok 4.6 也在 Claude Code 会话里出现过,大概率作为不同供应商的冗余通道;\n- Claude Code 承担规划、复盘、简历撰写和「在 Telegram 找哪里能卖韩国数据」等开放性任务;\n- LLM API 走代理\u002F转售商 xcai.pro,绕开直连供应商的支付和 KYC。\n\n这套多模型打法的形成需要三个前提同时到位:每个模型都有可控 API,代理\u002F转售商能串联多个供应商,以及代理工具能跨模型调度。三个条件在 2026 年下半年都已是公开服务,这就是为什么 CrowdStrike 判断「adversaries will likely continue to experiment with implementing AI tooling in their operations」。\n\n## agentic 工具的会话日志成为新的取证通道\n\n传统网络取证要面对的是结构化日志:进程、网络包、文件 hash。LLM agent 的取证天然多一层 —— 任何 prompt 和回复都会以 markdown 文件的形式持久化,挂在 `.claude\u002F`、`.config\u002F` 这类目录里。CrowdStrike 这次直接通过 `http[:]\u002F\u002F38.244.50[.]120:18899\u002F.claude\u002FCLAUDE.md` 拿到了攻击者的中文 pentesting prompt,又从香港 IP 的开放目录里下载了会话历史和 ARTEX 配置。\n\n这里的关键不是「攻击者忘了开防火墙」,而是「agentic 工具默认会把上下文当文件落到磁盘」。这给防御侧带来两点结论:第一,任何启用 Claude Code \u002F Cursor \u002F Codex 类 agent 的设备,只要被入侵,`.claude\u002F` 目录就是一份高密度情报源;第二,只要对端 LLM 提供商愿意配合执法,IP 段与账户绑定可以做主动溯源。\n\n## 这起攻击对中国 AI 工具出海的影响\n\nARTEX 是这次攻击的唯一「国产」元素。事件发生后,原作者 Autumn-27 公开声明 ARTEX 被滥用于攻击韩国银行,宣布闭源并从 GitHub 下架整库。这不是 ARTEX 本身有漏洞,而是攻击者用它做的 prompt 直接以中文写成,CrowdStrike 因此以「moderate confidence」判定威胁源是中文使用者。\n\n这件事给国内 agentic 工具出海带来一个微妙副作用:开源 ≠ 免责。如果一款工具公开提供 LLM 编排能力、又默认把上下文以明文形式写到磁盘,它未来被滥用的取证结果会反过来指向工具作者所在的生态。闭源不是技术答案,但是合规上更稳的选择。\n\n## 那么接下来会发生什么\n\nCrowdStrike 这次披露的不是「AI 第一次被用于攻击」,而是「AI agentic 工具的取证价值第一次被公开完整验证」。研究人员第一次拿到攻击者完整的 LLM 使用日志 —— 这是防御研究的一次结构性升级。\n\n对国内同行来说,这件事至少有三层启示:第一,给业务团队采购 agentic 工具时,默认审计 `.claude\u002F` 这类目录的留存路径;第二,做企业安全监控时,把 LLM 调用日志接进 SIEM 是迟早的事;第三,做 agentic 工具的团队,默认加密持久化文件,默认不向磁盘写明文 prompt —— 这不只是产品体验,也是下游取证层面的护城河。\n\nAI 时代的安全,正在从「拦截特征码」转向「还原调用链」。这场转向的早期样本,已经被一个广东的 26 岁年轻人亲自演示了。\n\n主要参考来源:CrowdStrike 10 月 7 日报告(https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Funknown-threat-actor-uses-artex-to-target-south-korean-finance\u002F);国内综合报道:网易《22秒攻破一家,韩国五大银行同时遭 AI 驱动黑客攻击》(https:\u002F\u002Fwww.163.com\u002Fdy\u002Farticle\u002FL8SIV45V0550W16F.html)。","https:\u002F\u002Fwww.163.com\u002Fdy\u002Farticle\u002FL8SIV45V0550W16F.html","d0b911cb-d6e3-4148-b330-a236df97df6f",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":19,"name":20,"slug":20,"description":14,"color":14},"b52db7e9-7c58-42c3-9536-5132cb2f8f72","deepseek",{"id":22,"name":23,"slug":23,"description":14,"color":14},"02bfdc0f-5e23-4fbb-b31a-7cc03cdba1ee","security",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"9016a3cd-275f-4d1c-874a-17f10f725d8b","en","Claude Code as Forensic Tool: Korean Bank Breach","ARTEX + Claude Code + DeepSeek + GLM-5.3 + Grok 4.6 hit Korean banks; Claude Code logs leaked the attacker. Agentic logs = new forensic channel.","In late September, abnormal traffic began surfacing across servers at several South Korean financial institutions, including Shinhan, KB Kookmin, and Hana Bank. Three months later, the industry got its first end-to-end look at AI-assisted attack tradecraft: a single threat actor wired an open-source Chinese agentic pentesting tool called ARTEX into four large language models — Claude Code, DeepSeek v4.1-flash, Zhipu GLM-5.3, and xAI Grok 4.6 — and ran parallel intrusions across multiple banks.\n\nThe twist is that the AI tool itself exposed the whole operation. CrowdStrike\\'s long-form report on October 7 shows that the attacker had left complete Claude Code session histories, ARTEX configuration files, and Claude memory files on a Hong Kong-based IP and on the second box at 38.244.50[.]120. Any researcher who walked into either open directory could read the attacker\\'s prompts, the model\\'s replies, and the personal details the attacker had typed alongside.\n\n## Claude Code quietly wrote out the attacker’s resume\n\nIn one Claude Code session, the actor asked Claude to draft a security researcher resume that summarized the ARTEX operation as bullet points. In the same prompt they pasted their own identifying details: name YY, 26 years old (DOB 2007-09-22), phone 17820191556, Telegram @YY520CN, Maoming city in Guangdong province, undergraduate at South China University of Technology. The same Telegram handle later showed up in vulnerability work against a Telegram-based NFT gift marketplace, and again in probes against an unidentified Chinese payment platform.\n\nIn other words, Claude Code inadvertently turned the attacker\\'s private context into a forensic log, parked it on an attacker-controlled box, and let a researcher download it in one click. From the attacker\\'s perspective this is textbook OPSEC failure; from the defender\\'s perspective it is a new kind of evidence — the more deeply an actor relies on an LLM, the more unstructured text they leak.\n\n## The multi-model stack is now attacker table stakes\n\nThe full tool reconstruction from CrowdStrike has one observation worth underlining: four models in parallel.\n\n- The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, doing routine scanning and exploitation work.\n- Zhipu GLM-5.3 supplemented Claude Code sessions, plausibly for Chinese-language tasks.\n- xAI Grok 4.6 also appeared in Claude Code sessions, most likely as a redundant cross-vendor channel.\n- Claude Code itself carried the open-ended work — planning, post-action review, resume drafting, and the question of where on Telegram to sell the Korean data.\n- All LLM API calls flowed through the reseller xcai[.]pro, sidestepping direct-vendor payment and KYC.\n\nThis multi-model pattern needs three conditions to fall into place at once: every model has a controllable API, resellers can bridge multiple vendors, and an orchestration tool can schedule across them. By late 2026 all three are commodity services. That is exactly why CrowdStrike judges that adversaries will likely continue to experiment with implementing AI tooling in their operations.\n\n## Agentic session logs are a new forensic channel\n\nTraditional network forensics deals in process trees, packet captures, file hashes. LLM-agent forensics adds a layer that does not exist anywhere else: every prompt and reply is persisted as a markdown file inside .claude\u002F or .config\u002F style directories. CrowdStrike pulled the attacker\\'s Chinese-language pentesting prompt straight from http[:]\u002F\u002F38.244.50[.]120:18899\u002F.claude\u002FCLAUDE.md, then downloaded session history and ARTEX configuration from the Hong Kong open directory.\n\nThe point is not that the attacker forgot to firewall the box. The point is that agentic tools default to writing context to disk. Two consequences follow on the defender side: first, any device running Claude Code, Cursor, or Codex that gets compromised now ships a high-density intelligence source in its .claude\u002F directory; second, when the upstream LLM provider cooperates with law enforcement, IP ranges and account bindings enable active attribution.\n\n## Implications for Chinese AI tooling going abroad\n\nARTEX is the only domestic element of this campaign. After the disclosure the original author Autumn-27 publicly stated that ARTEX had been misused to attack Korean banks, then closed the source and pulled the repository from GitHub. ARTEX itself had no vulnerability — the attacker simply wrote their prompts in Chinese, and that language signal let CrowdStrike make a moderate-confidence assessment that the threat actor is a Chinese-language speaker.\n\nThere is a side effect for Chinese agentic tooling going abroad: open source is not a liability shield. A tool that publicly offers LLM orchestration AND defaults to writing plaintext context to disk will eventually be linked, through forensic artefacts, back to the author community. Closing the source is not a technical answer, but it is the more stable choice on the compliance side.\n\n## So what happens next\n\nCrowdStrike\\'s disclosure is not the first time AI was used in an attack. It is the first time the forensic value of an AI agentic tool has been publicly verified end-to-end. For the first time researchers have a complete LLM usage log from the attacker side — that is a structural upgrade for defensive research.\n\nFor practitioners in China, three layers of implication fall out. First, when procuring agentic tools for business teams, audit the persistence paths of .claude\u002F style directories by default. Second, when running enterprise security monitoring, hooking LLM call logs into the SIEM is coming sooner than later. Third, for teams building agentic tools: encrypt persisted context by default, and stop writing plaintext prompts to disk — this is not just a product-experience question, it is a downstream-forensics moat.\n\nAI-era security is shifting from intercept signatures to reconstructing the call chain. The first public sample of that shift was demonstrated, on purpose or not, by a 26-year-old in Guangdong.\n\nReference source: CrowdStrike report dated October 7, 2026, \"Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance\" (https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Funknown-threat-actor-uses-artex-to-target-south-korean-finance\u002F); Chinese coverage at 163.com article (https:\u002F\u002Fwww.163.com\u002Fdy\u002Farticle\u002FL8SIV45V0550W16F.html).\n","claude-code-forensic-korean-bank-breach","2026-10-10T11:00:00Z","2026-10-10T11:06:22.736476Z","2026-10-10T11:06:22.736500Z",true,"agent",378,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"5796d012-e921-4760-b58f-653b90c151b1","Claude 削攻击面:25 个开源项目 493 处问题","claude-attack-surface-reduction-openssh","2026-10-22T05:20:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"488f30b2-34b1-48e4-b67f-9187f15c1a71","AI 抢先挖出 PHP 漏洞，披露窗口先被自己人捅破","openai-php-rce-coordinated-disclosure","2026-10-21T06:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"c2c96e3a-cc8d-4970-8d9d-e9584bbc9237","WhatsApp 帮助页藏 102 块 LLM 暗指令","whatsapp-hidden-llm-instructions-help-pages","2026-10-19T16:00:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"ac04da32-378f-403c-83c9-4cf2e29948e3","Claude半小时破解NSA曲线种子25年悬案","claude-nist-curve-seeds-lrand48","2026-10-17T19:20:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"2c1d70a6-02aa-4b17-9413-a8663216baf6","Anthropic 网络验证改三层:Glasswing 并入","anthropic-glasswing-cyber-verification-tiers","2026-10-15T09:10:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"acddc7d5-c389-4e90-8a7a-1001ce693395","Anthropic 反蒸馏到第三层:误拦也要收费,合法用户背成本","anthropic-distillation-shields-claude-paywall-blocks","2026-10-14T03:00:00+00:00"]