Artex AI, Claude agents used in cyberattacks on South Korean banks (www.bleepingcomputer.com)

In a striking incident, a Chinese-speaking hacker executed cyberattacks on several major South Korean banks, including Shinhan Bank and KB Kookmin Bank, using the ARTEX AI penetration testing suite and Claude agents. This breach led to the exposure of clients' personal data and credit card information, prompting the South Korean government to hold an emergency meeting to discuss immediate security fortifications for critical IT systems. Security firm CrowdStrike confirmed the involvement of ARTEX, previously an open-source platform, which has now transitioned to a closed-source model following this event. The technical analysis revealed that the attacker utilized ARTEX's DeepSeek v4.1-flash as the primary language model, augmented with GLM-5.3 and Grok 4.6 for enhanced capabilities. Researchers unearthed infrastructure details, including session histories and configuration files, which illustrated the sophistication of the breach. Importantly, the attacker's lack of a definitive monetization strategy for the stolen data raises questions about their motivations. The ongoing availability of ARTEX derivatives, despite its closure, highlights persistent security concerns within the AI/ML community, urging a reevaluation of the defenses against AI-facilitated threats.