ARTEX Agentic Pentest Tool and Claude Code Used to Breach South Korean Banks

South Korean financial institutions; reporting names Shinhan Bank, KB Kookmin Bank, and Hana Bank (BleepingComputer, Reuters) and Yegaram Savings Bank (The Hacker News)

CrowdStrike reported that a likely Chinese-speaking, financially motivated actor (moderate confidence) used ARTEX, an open-source multi-agent penetration testing tool developed in China, alongside Claude Code sessions to breach a bank's loan-progress inquiry service for brokers and another bank's employee mobile work-support system between late September and early October 2026. DeepSeek v4.1-flash was the main backend, likely bought through the reseller xcai[.]pro, with GLM-5.3 and Grok 4.6 in other sessions. Open directories on the actor's server exposed Claude Code session histories, memory files, a CLAUDE.md with a Chinese-language pentest prompt, and ARTEX configs; the actor also asked Claude where to sell Korean breach data. Reuters reported at least nine banks targeted, about 25,000 Shinhan customers and 119 KB Kookmin customers affected, and President Lee Jae Myung said there were signs AI was used. The ARTEX developer moved the project to closed source; derivatives remain available

Freely available agentic offensive tooling plus commercial model access let a single low-skill operator run several bank intrusions in parallel