ARTEX hackers use AI tools to attack South Korean banks
Original title: ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
Threat actor used Claude Code, DeepSeek and Grok to target South Korean banks, stealing data
A financially motivated threat actor targeted South Korean financial organizations using ARTEX with supporting AI models including DeepSeek v4.1-flash and Grok 4.6. The campaign resulted in data theft. Exposed directories revealed infrastructure and scripts.
Unconfirmed: Exact attribution of the threat actor
- Data theft from loan inquiry service and mobile platform
- Used AI for reconnaissance and exploitation
- Infrastructure in Hong Kong and China
Impact: data theft from financial organizations
- 1.review peripheral application access
- 2.enforce server-side authorization
- 3.investigate outbound connections to model resellers
- Vendors
- South Korean banks
- Threat actors
- ARTEX
- Victims
- South Korean banks
- Countries
- South Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xcai.pro | tional Claude Code sessions. Requests likely passed through xcai[.]pro, an API proxy or reseller associated with the campaign. H |
| ipv4 | 154.201.79.246 | institutions. Recovered proxy-enumeration scripts targeted 154.201.79[.]246:443, an address independently listed in CrowdStrike’s ind |
| ipv4 | 23.248.226.250 | the infrastructure picture through an exposed directory at 23.248.226[.]250:18099, a Hong Kong-based host containing 42 files across |
| ipv4 | 38.244.50.120 | vered credential files and shell scripts directly reference 38.244.50[.]120, the ARTEX server previously identified by CrowdStrike. T |
From the original article
3 min read at gbhackers.com
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.