[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-crowdstrike-artex-korean-banks-claude-leak":3,"topics-all":35,"news-related-1a2e34eb-569b-4197-a7d6-4eb8e24f0dce":54},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":21,"news_slug":28,"published_at":29,"created_at":30,"modified_at":31,"is_published":32,"publish_type":33,"image_url":14,"view_count":34},"1a2e34eb-569b-4197-a7d6-4eb8e24f0dce","韩国银行遭 AI 代理攻击,Claude 会话外泄操作者身份","CrowdStrike 10 月 7 日披露韩国金融机构遭 AI 代理入侵详情:开源工具 ARTEX 配合 Claude Code 等模型窃取数据,攻击者不慎把个人简历信息固化为会话上下文,在开放目录上被直接读出。","## 攻击轮廓:从 ARTEX 实例到客户端\\n\\nCrowdStrike 情报团队 10 月 7 日发布的报告还原了 9 月下旬到 10 月初针对韩国金融机构的代理化攻击链。[^cs]目标至少包括新韩银行、KB 国民银行、韩亚银行,一家被攻破用于金融经纪人的贷款进度查询服务,另一家的员工移动办公支持系统被攻陷。受袭机构之间出现 IP 重叠,显示同一攻击者协同执行。\\n\\n攻击者使用的代理渗透测试工具 ARTEX 由中国开发者 Autumn-27 开源,CrowdStrike 称之为 \"a recently released Chinese-developed open-source agentic penetration testing tool\"。[^thn] ARTEX 自身定位为 LLM 多智能体驱动的自主渗透系统,接上模型后把任务拆成探测、提权、横向移动等阶段。\\n\\n## 模型组合:四家厂商,一家代理\\n\\nCrowdStrike 在攻击者控制的开源目录中发现了 Claude Code 会话、ARTEX 配置文件和 Claude 记忆文件,直接揭开模型栈。报告写道,ARTEX 实例以 DeepSeek v4.1-flash 作为主 LLM 后端,这与攻击者通过香港 IP 路由的 Claude Code 附加会话搭配使用;部分会话启用了智谱 GLM-5.3 与 xAI 的 Grok 4.6。[^cs]\\n\\n调用流量通过 LLM API 中转代理 xcai[.]pro 发出,审计侧看到的是中转站边缘节点。代理 IP 列表共 9 个地址,核心 ARTEX 实例固定在 38.244.50.120。\\n\\n## 攻击者自己点的\"报警器\"\\n\\n最具噱头的细节在 Claude Code 会话历史里。攻击者让 Claude 撰写一份安全研究员简历,要求加进渗透测试成果的要点,同时也把以下个人信息一并塞进 prompt:姓名 YY、电话 17820191556、电报账号 @YY520CN、年龄 26、华南理工大学、广东茂名。\\n\\n这段内容一旦进入 Claude Code 会话存储,在攻击者把开源目录暴露在 38.244.50.120 端口之后,任何能连到这台机器的人——包括 CrowdStrike——都能拿到。CrowdStrike 表示,虽然这些细节很可能属于真实操作者,但他们不能把这一相关性钉死。\\n\\n攻击者还用 YY520CN 这个 Telegram 账号针对一个 Telegram 上的 NFT 赠品市场做过漏洞研究,这个账号也曾对某中国支付平台发起攻击。\\n\\n## MITRE ATT&CK 视角\\n\\nCrowdStrike 给出的战术归类归结为资源开发加命令控制链。T1583.003 \"Acquire Infrastructure: Virtual Private Server\" 对应攻击者批量获取 VPS;T1588.007 \"Obtain Capabilities: Artificial Intelligence\" 对应其部署开源 ARTEX 工具;T1090 \"Proxy\" 对应 9 个代理 IP 的轮换。这把 MITRE 2025 年把 AI 能力获取写进 T1588 子项时的判断坐实:LLM 本身已经成为可采购的攻击能力。\\n\\n## 评论\\n\\n这次事件同时给进攻方和防守方提了两个问题。\\n\\n进攻侧的边际成本被 ARTEX 类工具压到个人级别:有渗透想法但写不出扫描器的人,可以靠自然语言加几个开源库在两周内完成本来红队季度才能完成的攻击准备。\\n\\n防守侧的教训更直接:Claude Code 会话历史就是完整作案笔记。攻击者让模型写简历的请求一旦固化进 Claude 记忆文件并明文暴露外网,等同于把个人信息签名在攻击工具链上。对企业而言,AI 编码工具本地缓存、CLAUDE.md 类提示词文件、对外暴露的开发沙箱,都需要和源代码一样被视作敏感资产管控。\\n\\n韩国这次袭击不是孤例。Anthropic 9 月报告已经把与 Claude 对话发出威胁的对话转交执法部门视为案例之一;CrowdStrike 自己 9 月也发布过 LLM 生成的 PhantomRaven 信息窃取器。清晰的趋势是:AI 工具的生产力属性让业余犯罪者跨入持续入侵能力阶段,而留下的现场痕迹反倒越发直观。\\n\\n---\\n\\n参考来源\\n[^cs]: CrowdStrike, \"Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance\", 2026-10-07. https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Funknown-threat-actor-uses-artex-to-target-south-korean-finance\u002F\\n[^thn]: The Hacker News, \"ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms\", 2026-10-08. https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fartex-ai-pentesting-tool-used-in-data.html","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Funknown-threat-actor-uses-artex-to-target-south-korean-finance\u002F","d0b911cb-d6e3-4148-b330-a236df97df6f",[11,15,18],{"id":12,"name":13,"slug":13,"description":14,"color":14},"6ad31a14-c0da-42df-81fd-564281f768db","agentic-ai",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":19,"name":20,"slug":20,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",[22],{"id":23,"lang":24,"title":25,"summary":26,"content":27},"28359e6a-34bb-496d-b30e-dd99ec1d9544","en","Korean banks hit by AI-agent attack; Claude leaks operator","On October 7 CrowdStrike disclosed an AI-agent intrusion on South Korean banks. ARTEX chained with Claude Code; a résumé request exposed the operator.","## Attack Footprint: ARTEX Instance to Client\\n\\nCrowdStrike's intelligence team published a 10 October 2026 blog reconstructing an agentic intrusion chain against South Korean financial institutions that ran from late September into early October. [^cs] Targets included at least Shinhan Bank, KB Kookmin Bank and Hana Bank. At one victim, the attacker breached a loan-progress inquiry service used by financial brokers; at another, an employee mobile work-support system was compromised. Overlapping IP addresses across victims tied the activity to a single operator.\\n\\nThe agentic penetration testing tool ARTEX — developed in China by Autumn-27 and described by CrowdStrike as \"a recently released Chinese-developed open-source agentic penetration testing tool\" — sat at the center of the chain. [^thn] ARTEX positions itself as an LLM multi-agent-driven autonomous pentest system; once wired to a model, it splits a target into recon, exploitation, and lateral-movement phases.\\n\\n## Model Stack: Four Vendors, One Proxy\\n\\nClaude Code session histories, ARTEX configuration files and Claude memory files left on the operator-controlled open directories gave CrowdStrike a direct view of the model mix. The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, complemented by additional Claude Code sessions routed through a Hong Kong-based IP. Some sessions ran Zhipu AI's GLM-5.3 and xAI's Grok 4.6. LLM traffic flowed through the proxy xcai[.]pro — meaning audit logs see the proxy edge rather than the official DeepSeek domain. The core ARTEX instance sat at 38.244.50.120 with nine rotating proxy addresses.\\n\\n## The Operator's Own Alarm Bell\\n\\nThe most quotable detail sits inside the Claude Code session history. The attacker asked Claude to draft a security researcher résumé that included bullet points summarizing the ARTEX-related activity — and pasted these personal details into the same prompt: name YY, phone 17820191556, Telegram @YY520CN, age 26, South China University of Technology, Maoming Guangdong.\\n\\nBecause Claude Code persists session context, and because the operator left the open directory at port 18899 of 38.244.50.120 publicly exposed, anyone who reached that host — including CrowdStrike — could read the prompt verbatim. CrowdStrike stresses that while these details likely belong to the operator, they cannot prove attribution from a single artefact.\\n\\nThe same Telegram handle YY520CN was also used in vulnerability research against a Telegram-based NFT gift marketplace, and an unknown threat actor using that handle had previously targeted a Chinese payment platform.\\n\\n## MITRE ATT&CK Reading\\n\\nCrowdStrike's tactic breakdown fits a classic resource-development plus command-and-control shape. T1583.003 maps to bulk-acquiring VPS nodes; T1588.007 maps to deploying the open-source ARTEX tool; T1090 maps to nine-address rotation. This tagging vindicates MITRE's 2025 addition of the AI sub-technique under T1588: the LLM itself is now a procured attack capability.\\n\\n## Why It Matters\\n\\nTwo questions surface from this incident — one for offense, one for defense.\\n\\nOn offense, ARTEX-class tools collapse the marginal cost of capability to the level of an individual. Someone with a pentest idea who cannot write a modular scanner can now pair natural language with a few open-source libraries and replicate in two weeks what a red team would have taken a quarter to prepare. There is no need for an ongoing service — this is the new normal of \"general enough models, ready-made agents.\"\\n\\nOn defense, the takeaway is direct: a Claude Code session history is a complete crime notebook. Asking the model to draft a résumé exposes the answer to the public web when the open directory is left exposed. For enterprises, this means treating AI-coding-tool local caches, CLAUDE.md prompt files and externally reachable dev sandboxes with the same hygiene as source code: classify them as sensitive, log access, scan them for accidental PII before they are shared.\\n\\nSouth Korea was not an isolated case. Anthropic's September report counted Claude threats-to-harm conversations forwarded to law enforcement as a recurring category; CrowdStrike itself published an LLM-generated PhantomRaven infostealer in September. The clear trend is that the productivity property of AI tools is letting amateur operators cross into persistent intrusion territory while leaving trails that are easier, not harder, to read.\\n\\n---\\n\\nReferences\\n[^cs]: CrowdStrike, *Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance*, 2026-10-07. https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Funknown-threat-actor-uses-artex-to-target-south-korean-finance\u002F\\n[^thn]: The Hacker News, *ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms*, 2026-10-08. https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fartex-ai-pentesting-tool-used-in-data.html","crowdstrike-artex-korean-banks-claude-leak","2026-10-09T03:00:00Z","2026-10-09T05:08:32.331475Z","2026-10-09T05:08:32.331485Z",true,"agent",896,[36,45],{"slug":37,"tag_slug":37,"title_zh":38,"title_en":39,"intro_zh":40,"intro_en":41,"id":42,"is_active":32,"created_at":43,"modified_at":44},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":46,"tag_slug":46,"title_zh":47,"title_en":48,"intro_zh":49,"intro_en":50,"id":51,"is_active":32,"created_at":52,"modified_at":53},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":55},[56,61,66,71,76,81],{"id":57,"title":58,"news_slug":59,"published_at":60},"b7d78fbe-0df8-4369-aa61-33b05419ed6b","硬币决定 AI 的立场,86% 分析师跟着它走","anthropic-agents-judgment-calls-study","2026-10-27T01:00:00+00:00",{"id":62,"title":63,"news_slug":64,"published_at":65},"c603ba6b-a6ff-4821-ae4c-488ecca06a60","Claude 攻入 OpenAI 内部代码库:HEIF 图片捅穿 SSO,全程不到 72 小时","hacktron-claude-openai-heif-sso-breach","2026-09-18T17:12:43+00:00",{"id":67,"title":68,"news_slug":69,"published_at":70},"9785c9bb-85a0-4b97-8890-aa2d6808bf86","Agent记忆陷阱:良性对话把不安全操作率推到81%","agent-memory-trap-benign-overgeneralization","2026-11-08T15:12:52+00:00",{"id":72,"title":73,"news_slug":74,"published_at":75},"950e298b-7e72-443b-939e-ef8ba07ee677","多模态社工攻破7个智能体:验证越多被骗越狠","multimodal-sea-social-engineering-agent-security-benchmark","2026-11-08T09:05:00+00:00",{"id":77,"title":78,"news_slug":79,"published_at":80},"92267597-eb39-4323-a5db-f7db3821f392","安全对齐被反用:一条假差评就能改掉智能体的选择","voluntary-servitude-agent-safety-attack","2026-11-05T01:05:00+00:00",{"id":82,"title":83,"news_slug":84,"published_at":85},"2a16565e-87a9-4f83-955b-557b9b6ba5bb","AI 税务基准:10.8% 通过率,专业活还是干不动","surge-dayjob-tax-agent-benchmark","2026-10-29T09:05:00+00:00"]