Chinese attacker used ARTEX and Claude AI agents to compromise South Korean financial institutions in recent campaign

CrowdStrike identified a Chinese-speaking hacker who breached data from South Korean financial firms earlier this month. The attacker deployed agentic penetration testing tool ARTEX alongside Claude AI agents to conduct the campaign against the banking sector.

This operation highlights the growing use of artificial intelligence in cyberattacks against critical infrastructure. According to Infosecurity Magazine, the hacker used these specific AI tools to help breach data from South Korean financial institutions. The combination of automated testing suites and large language models allowed for rapid exploitation.

Attack Methodology

The threat actor relied on a sophisticated combination of tools to bypass security measures. BleepingComputer reports that the cyberattacks shaking the South Korean financial sector were launched using the ARTEX AI penetration testing suite. The attacker also integrated Claude agents into the workflow to automate parts of the intrusion process.

This approach suggests a shift toward AI-assisted penetration testing in the wild. The use of ARTEX indicates that commercial or advanced pentesting tools are being repurposed for malicious ends. The integration of Claude agents points to an attempt to automate decision-making during the attack lifecycle.

Who Is Affected

South Korean banks and financial firms are the primary victims of this campaign. The attacks occurred earlier this month, causing operational disruptions and data breaches within the sector. While specific bank names were not detailed in the initial reports, the financial industry in South Korea is broadly affected.

Small-business owners in the financial services sector should be aware that AI-driven attacks are no longer limited to large enterprises. The use of automated tools lowers the barrier to entry for sophisticated attacks. This means that smaller institutions may face similar risks if they rely on standard security configurations.

Defender's checklist

Security teams should review their logs for signs of automated penetration testing activity. Look for unusual patterns in network traffic that may indicate the use of AI agents. Monitor for any unauthorized access attempts that occur in rapid succession.

Organizations should also assess their exposure to external attack surfaces. Ensure that all systems are patched and that access controls are strictly enforced. Be vigilant for any indicators of compromise related to the ARTEX tool or similar AI-driven suites.

Background: AI agents

An AI agent is a software system that perceives its environment, makes decisions, and takes actions to achieve specific goals without constant human input. Unlike passive tools, agents execute tasks, browse data, and interact with other systems autonomously.

Read the full guide: AI Agents Defined: Autonomy, Risk, and Real-World Use

What to do and how to stay safe: ARTEX

• Monitor network logs for unusual automated activity that may indicate AI-driven penetration testing.
• Review access controls and ensure that only authorized personnel can access sensitive financial data.
• Keep all software and security tools updated to protect against known vulnerabilities.
• Educate staff on recognizing signs of compromise and reporting suspicious activity immediately.

Step-by-step guide: Implementing AI Usage Policies at Work: A Step-by-Step Framework

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tools did the attacker use?

The attacker used the ARTEX AI penetration testing suite and Claude agents to breach South Korean banks.

Who is behind this attack?

CrowdStrike identified a Chinese-speaking hacker as the threat actor behind the campaign.

Which sector was targeted?

The South Korean financial sector, including banks and other financial firms, was targeted.