ARTEX Used Against South Korean Financial Institutions

Researchers say a threat actor used ARTEX against South Korean financial firms, exposing data on at least 68,000 people.

Zscaler ThreatLabz reported that a threat actor used the ARTEX agentic penetration-testing framework against South Korean financial institutions, with LLM-driven agents scanning peripheral customer and employee web applications and exploiting SQL injection and authentication-bypass flaws to steal names, phone numbers, incomes, and loan limits. Recorded Future’s Insikt Group attributes related activity to TAG-217 and says the actor was testing infrastructure and assembling tools from mid-August 2026, before the Financial Services Commission disclosed in early October that multiple institutions were compromised. Public reporting cited by Recorded Future said personal data of at least 68,000 people across at least seven firms was exposed; Zscaler did not publish those figures. Both sources link the campaign to ARTEX and Claude Code. Recorded Future also names DeepSeek, Grok, and Zhipu AI plus residential proxies, while Zscaler says Claude Code was used to discuss selling the stolen data on Korean-language Telegram channels and that ARTEX default guardrails blocked government and university targets but not financial institutions. Exposed directories reviewed by Recorded Future showed additional tools aimed at YiiMP wallet theft, Linux credential access, and mobile-device testing, though those efforts were not shown to have succeeded. The sources do not contradict the core incident but differ on actor naming, scale, and the set of tools described.

• Zscaler ThreatLabz reported that ARTEX agents scanned peripheral customer and employee web apps at South Korean financial institutions and exploited SQL injection and authentication-bypass flaws.
• Stolen records described by Zscaler included names, phone numbers, incomes, and loan limits; the actor used Claude Code to discuss selling that data on Korean-language Telegram channels.
• Zscaler said ARTEX default guardrails blocked government and university targets but not financial institutions.
• Recorded Future attributes the activity to TAG-217 and says infrastructure testing and tool assembly began in mid-August 2026, before early-October disclosures.
• The Financial Services Commission disclosed that multiple institutions were compromised; public reporting cited by Recorded Future said data on at least 68,000 people across at least seven firms was exposed.
• Recorded Future describes ARTEX as a Chinese-language open-source AI pentesting framework used with Claude Code, DeepSeek, Grok, and Zhipu AI, with traffic routed through residential proxies.
• Exposed directories also showed tools for YiiMP cryptocurrency-wallet theft, Linux credential access, and mobile-device testing; Recorded Future said those efforts were not shown to have succeeded.