Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
An unidentified threat actor, likely Chinese-speaking and financially motivated, conducted targeted attacks against South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The adversary utilized ARTEX, a Chinese-developed open-source agentic penetration testing tool, combined with large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Analysis of exposed directories revealed Claude Code session histories, ARTEX configuration files, and operational details showing a two-server architecture involving Hong Kong-based infrastructure. The threat actor demonstrated sophisticated tradecraft by leveraging AI tooling to enhance operational tempo, enabling multiple intrusions within a compressed timeframe. Evidence suggests the attacker also researched Korean data breach marketplaces and Telegram channels for selling stolen information.
Pulse ID: 6ac8a22f8d0ad1ea5f056ddc
Pulse Link: https://otx.alienvault.com/pulse/6ac8a22f8d0ad1ea5f056ddc
Pulse Author: AlienVault
Created: 2026-10-09 08:13:35
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Chinese #DataBreach #HongKong #Telegram #OTX #AlienVault