Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
A threat actor used the ARTEX agentic pentest framework to steal financial PII from South Korean institutions.
Zscaler ThreatLabz reported a threat actor using the ARTEX agentic penetration-testing framework against South Korean financial institutions. LLM-driven agents scanned peripheral customer and employee web applications, then exploited SQL injection and authentication-bypass flaws to steal names, phone numbers, incomes, and loan limits. The actor later used Claude Code to discuss selling the stolen personal data on Korean-language Telegram channels. ARTEX default guardrails blocked government and university targets but not financial institutions.
- ARTEX agents probed peripheral web apps at South Korean financial institutions.
- Agents exploited SQL injection and authentication bypass for unauthorized access.
- Stolen records included names, phone numbers, income, and loan limits.
- The actor used Claude Code to plan selling the stolen PII.
- Default ARTEX blocklists covered government and universities, not banks.
Full article308 words · extracted from zscaler.com · click to collapse
How it Works
The campaign unfolds in four phases from ARTEX-assisted reconnaissance and exploitation to data theft and monetization planning.
- Reconnaissance: ARTEX agents autonomously identified and probed peripheral internet-facing web applications outside the institutions’ core banking infrastructure, including customer-facing inquiry portals and employee-facing mobile application backends.
- Exploitation: LLM-driven agents identified and exploited vulnerabilities including SQL injection and authentication bypass in the peripheral web applications to gain unauthorized access.
- Data exfiltration: Stolen records included full names, phone numbers, annual income figures, and loan limits. This information could support subsequent financial fraud and social engineering.
- Monetization planning: The threat actor used Claude Code sessions to seek advice on selling stolen South Korean financial PII and to locate Korean-language Telegram channels used to sell stolen data.
Attack chain
The attack chain below illustrates the four phases of the campaign.
Figure 1: ARTEX attack chain, from reconnaissance and exploitation to data exfiltration and monetization planning.
ARTEX architecture and agent workflow
ARTEX uses an orchestration layer, known as a harness, to coordinate its models and agents. The harness provides the model with the current task state and previous results. The model selects the next action, a worker executes the selected tool against the target, and the results are returned to the model to inform subsequent actions.
The planner divides the engagement into tasks, while worker agents execute tools and store findings, and the reporting component generates a report containing validated findings.
The harness supported multiple LLM backends. In this campaign, the threat actor configured ARTEX to use the services listed in Table 1.
ARTEX guardrails and scope controls
ARTEX included guardrails intended to restrict targeting of government entities and universities through a default blocklist. However, these restrictions did not extend to financial institutions, as shown in ARTEX’s source code below.
Figure 2: ARTEX source code defining default government and education domain filters.