ARTEX Hackers Expose Servers Revealing AI Tools in South Korean Bank Breaches
Original title: ARTEX Hackers Expose Their Own Servers, Revealing AI Tools Behind South Korean Bank Breaches
Hackers left servers open exposing ARTEX framework with Claude Code DeepSeek GLM and Grok models used in breaches affecting 66,000 to 67,000 people and 2,200 companies across seven South Korean banks.
Researchers discovered an open-source AI penetration testing framework called ARTEX used in intrusions into South Korean financial institutions. The operator exposed servers and files showing custom skills for reconnaissance and exploits. A Hong Kong jump host contained state files and scripts for routing requests through AI model resellers.
Unconfirmed: Link between exposed tools and bank breaches is unconfirmed
- Seven South Korean banks affected
- 66,000 to 67,000 individuals and 2,200 companies impacted
- ARTEX framework taken down October 11 2026
- Custom skills used 147 times
- Proxy enumeration and JNDI LDAP exploits found
Impact: data theft including names jobs income and loan details
- 1.Close public access to admin services
- 2.Reset SSH passwords and rotate API keys
- 3.Monitor for unusual LDAP JNDI traffic and DNS callbacks
- Vendors
- CrowdStrikeGeniansHunt.io
- Threat actors
- ARTEX hackersChinese-speaking lone operator
- Countries
- South KoreaHong KongChina
- AI models
- Claude Code 2.1.221DeepSeekGLMGrok
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | direct.xcai.pro | ]pro Domain AI service reseller domain tied to the campaign direct[.]xcai[.]pro Domain Endpoint in the model-routing configuration fofo |
| domain | fofoapi.com | ai[.]pro Domain Endpoint in the model-routing configuration fofoapi[.]com Domain Third-party API used by the recovered FOFA client |
| domain | u6ud2s.dnslog.cn | om Domain Third-party API used by the recovered FOFA client u6ud2s[.]dnslog[.]cn Domain DNS callback host in the staged exploit 38.244.5 |
| domain | xcai.pro | ed one key server at 38.244.50[.]120 and a reseller domain, xcai[.]pro, used to reach AI models. Genians later confirmed the sam |
| ipv4 | 154.201.79.246 | e than bank-related tools. Hunt.io found a proxy service at 154.201.79[.]246:443 that gave 79 unique exit IP addresses from the first |
| ipv4 | 23.248.226.250 | ng off the known server, they found a new open directory at 23.248.226[.]250, a Hong Kong jump server that held far more of the operat |
| ipv4 | 38.244.50.120 | n hacking group. The public reports named one key server at 38.244.50[.]120 and a reseller domain, xcai[.]pro, used to reach AI model |
| sha256 | c7a884afcd7f91408921890d9617bef6bfac3dae992bc25bb9c48c0395a60842 | and port Directory hosting the JNDI/LDAP exploitation setup C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842 SHA-256 certificate fingerprint TLS certificate on 38.244.5 |
From the original article
4 min read at cybersecuritynews.com
A hacker’s own mistake has given researchers a rare look at how AI tools were used to break into South Korean financial firms. The operator left several servers open to the public, and the exposed files showed which AI models, scripts and proxies powered the campaign. Between late September and early October 2026, seven South […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.