A series of cyberattacks between late September and early October 2026 resulted in the compromise of seven South Korean financial institutions. The breaches led to the exposure of sensitive personal, employment, income, and loan-related data belonging to approximately 66,000 individuals and 2,200 corporations. Security researchers have linked these incidents to the use of an open-source autonomous penetration testing framework known as ARTEX.
Investigations by multiple security firms, including CrowdStrike, Genians, and Hunt.io, have identified ARTEX as the primary toolset utilized in the campaign. The framework, which is licensed under AGPL-3.0 and was developed in China, was removed from its official GitHub repository and Docker registry on October 11, though various mirrors and forks remain in circulation. While the identity of the operator remains unconfirmed, analysts have assessed with moderate confidence that the activity was carried out by a single Chinese-speaking individual motivated by financial gain rather than a formal state-sponsored threat group.
The technical infrastructure supporting the attacks relied on a two-server configuration. One component was a jump server located in Hong Kong, while the second was a console hosted on a server at 38.244.50[.]120, situated on a network in Los Angeles. Hunt.io observed that the console server featured an interface with a Chinese-language title translating to "autonomous penetration testing console." Additional infrastructure included a reseller domain, xcai[.]pro, and a rotating proxy service that utilized dozens of unique exit IP addresses to mask the operator's origin.
A significant aspect of the campaign was the integration of artificial intelligence to automate various stages of the attack lifecycle. The framework utilized Claude Code version 2.1.221, though it was configured to bypass official Anthropic connections. Instead, the operator employed custom scripts, such as ds-models-shim.py, to redirect requests to other backends, primarily DeepSeek v4.1 Flash, with GLM 5.3 and Grok 4.6 serving as secondary models. This setup allowed the attacker to maintain a persistent, automated workflow that bypassed compatibility issues between the agent and the third-party AI models.
The framework contained 19 custom "skills"—reusable instruction sets designed to automate specific malicious tasks. These included reconnaissance, code auditing, web application firewall bypass, authentication testing, and the decompiling of Android applications. Evidence recovered from an exposed directory on the jump server indicated that the operator specifically targeted payment logic and insecure direct object reference vulnerabilities, which aligns with the methods used to access the Korean financial services.
Further analysis of the recovered files revealed a broad range of supporting tools, including scripts for querying the asset search engine FOFA and utilities for JNDI and LDAP exploitation. The infrastructure also housed code related to Linux privilege escalation, iOS probing, and cryptocurrency exchange manipulation. While the operator maintained a collection of self-registered test accounts for payment APIs, they characterized these as authorized, self-built testing environments.
The discovery of the ARTEX console and its associated scripts has provided a detailed look at how modern automated frameworks can be repurposed for illicit activity. Researchers have confirmed that the exposed directories contained logs, reverse SSH tunnel configurations, and proxy management scripts, all of which were left accessible without adequate authentication. Following the disclosure of these findings, security organizations have emphasized the importance of monitoring for the specific indicators of compromise associated with the ARTEX framework to prevent further exploitation of internet-facing financial systems.
