Key points
- CrowdStrike Intelligence identified the campaign active from late September to early October 2026.
- Threat actors used the ARTEX AI penetration testing tool and large language models.
- The attacks resulted in data exfiltration from South Korean financial organizations.
- Open directories left by attackers provided evidence of the breach methods.
Threat actors targeted South Korean financial firms in late 2026 using an artificial intelligence penetration testing tool. According to CrowdStrike Intelligence, the campaign ran from late September to early October 2026. The group successfully exfiltrated data from these organizations during this period.
In plain English
The attackers used ARTEX, a tool designed for authorized security testing, to break into systems. They combined this software with large language models to automate their actions. This approach allowed them to identify weaknesses faster than manual methods. The primary vector was misconfigured directories that remained open to the public.
The background
Researchers analyzed working notes left behind by the intruders at the breach sites. These files revealed how the group used the ARTEX tool alongside LLMs. The activity focused specifically on the financial sector in South Korea. CrowdStrike published details of this campaign after reviewing the digital forensics evidence.
What changes now
Organizations must review their public-facing directory structures immediately. Leaving internal paths accessible allows attackers to map networks easily. Security teams should audit configurations for any unintended exposure. No patch for the ARTEX tool itself has been confirmed yet.
What to do and how to stay safe: ARTEX
- Audit public directories to ensure no internal paths or sensitive files are accessible without authentication.
- Monitor logs for unusual automated scanning patterns that may indicate the use of AI-driven tools.
- Review access controls on financial data repositories to limit exposure if a perimeter is breached.
- Once the vendor provides an update, apply it to any systems using similar penetration testing frameworks.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What tool was used in the South Korean bank attacks?
The attackers used ARTEX, an AI-driven penetration testing tool, combined with large language models.
When did the campaign take place?
CrowdStrike Intelligence reported the activity was active from late September to early October 2026.
Were there any confirmed fixes for the vulnerabilities?
No fix has been confirmed yet; the report focuses on the attack method and exfiltration.
