Security AffairsPierluigi Paganini
Hunt.io traces ARTEX tools to breaches at South Korean banks
Part of the ARTEX story · since 25 Oct
- Sun 25 Oct, 16:01 UTC. SecurityOnline, first report. Chinese Operator Used ARTEX AI in Global Hacking Campaign.
- Mon 26 Oct, 10:30 UTC. SecurityOnline. Researchers expose Android spyware targeting Telegram and WeChat.
- Fri 30 Oct, 19:00 UTC. The Hacker News, its first report on the story. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks. This article, 16th of 16.
Hunt[.]io has traced ARTEX, an open‑source AI hacking framework, to a campaign in which seven South Korean financial institutions suffered data breaches between late September and early October 2026. The intrusions affected around 66,000–67,000 individuals and about 2,200 corporate records, exposing personal, employment, income and loan information. CrowdStrike and Genians Security Center previously highlighted the activity; Hunt[.]io’s analysis adds detail on the infrastructure and tooling.
The operation reportedly used a two‑server setup with a Hong Kong-based primary infrastructure and a server at 38.244.50[.]120 hosting the ARTEX console, with access via ports 443 and 8090. Nine proxies and a Hong Kong jump host were identified, and the ARTEX GitHub repository and Docker image were removed on 11 October 2026, though forks remain.
Hunt[.]io describes the ARTEX toolkit in depth: a two‑server chain linking a Claude‑Code harness (version 2.1.221) to DeepSeek language models, with shim scripts (notably ds-models-shim.py) to address model endpoint compatibility and to forward requests to DeepSeek. The artefacts include 19 local skills and 147 uses, covering web injection, authentication testing, FTP/APK workflows, and even test accounts tied to a cash‑in API.
Additional directories held SSH tunnels, proxy configurations, and APIs tied to Zhipu AI and OpenAI‑compatible relays. The report notes risks from exposed admin services, reusable credentials, remote access tunnels and exploitation tooling. Hunt[.]io says defenders should remove public access, require VPNs or allowlists for administration, rotate exposed keys, patch internet‑facing services and monitor for LDAP/JNDI activity and DNS callbacks. The findings are attributed to Hunt[.]io’s investigation, with the indicators of compromise published by Hunt[.]io.
How the story developed
16 articles from 10 outlets since 25 Oct. Still developing; the latest report was 20 hours ago. This was the 16th report, 13 days after the first.
- Sun 25 Oct, 16:01 UTC. SecurityOnline, first report. Chinese Operator Used ARTEX AI in Global Hacking Campaign.
- Mon 26 Oct, 10:30 UTC. SecurityOnline. Researchers expose Android spyware targeting Telegram and WeChat.
- Fri 30 Oct, 19:00 UTC. The Hacker News, its first report on the story. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks. This article, 16th of 16.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 16 articles as a listHide the list
- Sun 25 OctDay 01
- Chinese Operator Used ARTEX AI in Global Hacking Campaign16:01 · SecurityOnline · First report
- Mon 26 OctDay 11
- Researchers expose Android spyware targeting Telegram and WeChat10:30 · SecurityOnline
Quiet for 4 days
Fri 30 OctDay 51- CrowdStrike links Vapor Panda to global AI powered intrusion campaign19:00 · The Hacker News · Picked up again
Quiet for 2 days
Sun 1 NovDay 71- AI hacking tool ARTEX now used by cybercriminals to target finance09:20 · cybersixt
- Mon 2 NovDay 81
- North Korean groups use AI to accelerate cyber operations09:00 · SecurityOnline
- Tue 3 NovDay 93
- WorkOS data breach came from a researcher's escaped ARTEX agent00:51 · cybersixt
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys06:30 · The Hacker News
- Chainstack Breach Exposes Customer Data and Password Hashes19:30 · The Hacker News
- Wed 4 NovDay 102
- Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts11:00 · badbyte.io
- Wiz links AI platform breaches to stolen access tokens13:30 · SecurityWeek
- Thu 5 NovDay 113
- Backdoored ARTEX Docker image exposed 62 consoles to root access10:30 · The Hacker News
- Check Point details AI driven ARTEX cybercrime campaigns18:00 · Check Point
- Fri 6 NovDay 121
- Censys finds 1,465 internet exposed ARTEX consoles13:30 · Infosecurity
- Sat 7 NovDay 132
- Storm-3358 uses ARTEX to target financial organisations04:00 · Microsoft
- Hunt.io traces ARTEX tools to breaches at South Korean banks20:30 · Security Affairs · This article, 16th of 16