Attackers Reportedly Used ARTEX, an AI Security-Testing Tool, to Steal Data from South Korean Financial Institutions

An unidentified attacker reportedly used ARTEX, an AI-powered security-testing tool, alongside large language models to breach South Korean financial institutions and steal data. Compromised systems included a loan-broker inquiry service and an employee mobile work-support system. Researchers linked the activity to exposed attacker infrastructure and AI session histories. The attacker’s identity and the full number of affected institutions remained unconfirmed.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The threat actor used agentic AI tools and LLMs to conduct targeted cyberattacks against South Korean financial institutions, exfiltrating sensitive data.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The cyberattacks resulted in data breaches and the exfiltration of non-public financial and customer data from South Korean banks.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated and executed by a human threat actor who intentionally used AI systems to conduct cyberattacks and exfiltrate data.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI systems utilized (DeepSeek, GLM, Grok, Claude Code) are general-purpose large language models and code assistants, which function as chatbots and interactive tools, falling under the Limited Risk category.

AI system and alleged parties

• AI system: ARTEX, DeepSeek, GLM, Grok (DeepSeek, Zhipu AI, xAI)
• AI purpose: Code Generation; Question Answering
• Behaviour type: Agent
• Alleged developer: Zhipu AI, xAI, Large language model developers, DeepSeek, Autumn-27, ARTEX developers, Anthropic, AI agent system developers
• Alleged deployer: Threat actors, hackers, Cybercriminals, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Shinhan Bank, Privacy, KB Kookmin Bank, Information integrity, General public of South Korea, General public, Financial institutions, Customers, Banks, Bank customers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes data breaches resulting in exfiltrated data from South Korean financial organizations.

Directly caused: The threat actor exfiltrated data from a loan progress inquiry service and an employee mobile work-support system.

Inferred additional harm: It is highly likely that the exfiltrated data contained personally identifiable information (PII) and financial records of thousands of bank customers, violating their privacy.

People affected

• Occurrences reported: 1

Potential causes

Management

• Inadequate API Partner Monitoring: LLM providers failed to block abusive API resellers like xcai.pro.

Technology

• Agentic Pentesting Tool Availability: Open-source agentic tool ARTEX enabled automated offensive operations.
• Dual-Use LLM Capabilities: LLMs like DeepSeek and Grok were used for offensive cyber operations.
• API Proxy Bypass of Controls: API reseller xcai.pro allowed access to LLMs bypassing standard safety filters.

Data Inputs

• Malicious Prompts: Chinese-language pentesting prompts guided the LLMs to execute attacks.
• Lack of Input Safety Filtering: LLM inputs did not block requests for finding stolen data sales channels.
• Session History Exposure: Claude Code session histories and memory files were left in open directories.

Human Factors

• Malicious Intent of Operator: Financially motivated attacker leveraged AI to accelerate intrusion tempo.
• Abuse of Coding Assistants: Attacker used Claude Code to assist in vulnerability research.

Process and Methods

• Inadequate API Access Controls: Lack of robust verification by API resellers allowed malicious access.
• Lack of AI Output Guardrails: AI models provided actionable advice on where to sell exfiltrated data.

Regulatory Environment

• Unregulated Open-Source AI Tools: No regulations restricted the release of agentic pentesting tools like ARTEX.
• Lack of API Reseller Oversight: API proxies operate with minimal regulatory oversight, enabling abuse.

Information quality

• Classification confidence: High
• Reason for confidence: The report from CrowdStrike provides highly detailed technical indicators, including specific IP addresses, tool configurations, and session histories. The role of the AI systems and the nature of the cyberattack are clearly documented, leaving little ambiguity about the technical execution.
• Ambiguities identified: The exact identity of the threat actor (YY) is not definitively confirmed, and the total number of affected financial organizations and compromised customer records remains unconfirmed.
• Alternative interpretations: None. The incident is clearly a malicious cyberattack facilitated by agentic AI tools.

A financially motivated cyberattack campaign successfully targeted South Korean financial institutions using the agentic AI tool ARTEX and multiple LLMs. The incident highlights an evolved capability where malicious actors leverage AI agents to automate and accelerate data exfiltration, posing substantial risks to economic and technological security.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: South Korea
• Alleged perpetrator: Likely Chinese-speaking, financially motivated threat actor

Threat characteristics

• Imminence: Long-term. The specific campaign has concluded, but the method represents an ongoing, strategic threat of AI-enabled cyber operations against financial sectors.
• Autonomy: Human-supervised. The threat actor leveraged ARTEX, an agentic penetration testing tool that autonomously executes actions based on human-provided prompts and configurations.
• Novelty: Evolved capability. While cyberattacks on banks are common, the integration of agentic AI tools with multiple LLMs to automate and execute the campaign represents an evolved capability.

Impact by dimension

• Physical security: Negligible. No physical systems or critical infrastructure control systems were compromised or manipulated during this cyberattack.
• Information security: Minor. While the threat actor used advanced LLMs to facilitate cyber tactics and exfiltrate data, there is no evidence of state-level intelligence compromise or systematic disinformation.
• Sovereignty: Negligible. The attacks targeted commercial financial institutions rather than government operations, constitutional processes, or sovereign decision-making.
• Economic security: Substantial. The campaign targeted multiple South Korean financial institutions, successfully compromising a loan inquiry service and an employee work system, leading to data exfiltration.
• Societal stability: Minor. The exfiltration of financial and customer data compromises individual privacy, though it did not lead to mass surveillance, societal manipulation, or civil unrest.