ARTEX AI hacking tools linked to South Korean bank breaches
Original title: Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches
Hunt.io traced ARTEX servers and AI tools used in breaches affecting 66,000 to 67,000 people and 2,200 corporations.
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. The infrastructure included a server at 38.244.50[.]120 and a Hong Kong address. Hunt.io notified the relevant national CERT before publishing the report. Hunt.io says their connection to the Korean breaches isn’t confirmed.
Unconfirmed: Hunt.io's connection to the Korean breaches is not confirmed.
- Seven South Korean financial institutions affected
- 66,000 to 67,000 people impacted
- 2,200 corporations affected
- ARTEX framework used in the campaign
- Hunt.io notified national CERT
- Products
- ARTEX
- Threat actors
- Chinese-speaking individual
- Countries
- South KoreaChinaHong Kong
- AI models
- DeepSeek v4.1 FlashGLM 5.3Grok 4.6
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xcai.pro | k 4.6 as backups, reached partly through a reseller domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, |
| ipv4 | 130.94.31.86 | ttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156 |
| ipv4 | 154.201.79.246 | n use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 1 |
| ipv4 | 156.251.11.39 | [.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writ |
| ipv4 | 23.248.226.250 | m for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files |
| ipv4 | 38.244.50.120 | domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address |
From the original article
5 min read at securityaffairs.com
Hunt. io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.