[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHCV0aW-Oz_56RsaiFkmFFaR5EgG0jH2MUiVOiTtKqwI":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"277e35a3-5ebf-4b40-b6ca-856bb1258fb5","ARTEX AI, Claude agents used in cyberattacks on South Korean banks","artex-ai-claude-agents-used-in-cyberattacks-on-south-korean-banks-c1d059","The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. [...]","A Chinese-speaking hacker targeted multiple South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, using the ARTEX AI penetration testing suite and Claude agents. The attacks resulted in the exposure of client data and credit card information, and caused system outages. CrowdStrike confirmed the use of ARTEX AI and identified the attacker's infrastructure, which included Claude Code session histories and memory files.","Chinese hacker uses ARTEX AI and Claude agents to attack South Korean banks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F09\u002Frobot-hacker.jpg","2026-10-10T14:16:17+00:00","2026-10-10T16:00:19.454369+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"ARTEX AI","product",{"name":21,"type":19},"Claude agents",{"name":23,"type":19},"Claude Code",{"name":25,"type":19},"DeepSeek v4.1-flash",{"name":27,"type":19},"GLM-5.3",{"name":29,"type":19},"Grok 4.6","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"domain","xcai.pro","Likely LLM API proxy\u002Freseller used to access DeepSeek",[18,21,23],{"controls":60,"vendors":141},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":120,"name":121,"problem":122,"products":123},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[124,132,133],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[142],{"slug":75,"name":76,"logo_path":77,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":163},"ai-powered-penetration-tools-weaponized-against-south-korean-banks","AI-Powered Penetration Tools Weaponized Against South Korean Banks","A Chinese-speaking threat actor leveraged ARTEX AI, a penetration testing suite, alongside Claude AI agents to conduct sophisticated attacks against multiple major South Korean financial institutions, resulting in client data and credit card information exposure as well as system outages. The incident highlights the dual-use danger of AI-assisted security tools, which can be repurposed by adversaries to automate and accelerate cyberattacks at scale. The discovery of Claude Code session histories and memory files in the attacker's infrastructure suggests insufficient monitoring of AI tool usage and inadequate controls around sensitive data environments. Financial institutions must recognize that AI-augmented threats can outpace traditional defenses, making proactive detection and layered security controls essential. This attack underscores the urgent need for banks to monitor for AI-driven attack patterns and enforce strict data access boundaries around customer financial records.",[150,151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-6 – Audit Record Review and Analysis","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 IR-4 – Incident Handling","NIST AI RMF – Govern 1.1 (AI Risk Policies)","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","PCI DSS Requirement 10 – Log and Monitor All Access to System Components","PCI DSS Requirement 7 – Restrict Access to Cardholder Data",{"CIS Control 3 – Data Protection":164,"CIS Control 8 – Audit Log Management":165,"NIST SP 800-53 IR-4 – Incident Handling":166,"NIST SP 800-53 SI-4 – System Monitoring":167,"GDPR Article 32 – Security of Processing":168,"NIST SP 800-53 AC-3 – Access Enforcement":169,"CIS Control 6 – Access Control Management":170,"NIST AI RMF – Govern 1.1 (AI Risk Policies)":171,"CIS Control 13 – Network Monitoring and Defense":172,"GDPR Article 33 – Notification of Personal Data Breach":173,"NIST SP 800-53 AU-6 – Audit Record Review and Analysis":174,"PCI DSS Requirement 7 – Restrict Access to Cardholder Data":175,"PCI DSS Requirement 10 – Log and Monitor All Access to System Components":176},"Encrypting and segmenting client and card data limits what an AI-assisted intruder can extract from South Korean banks after gaining access.","Centralised audit logs help detect the high-speed, automated activity of AI-driven attack tools moving through banking systems.","Incident handling plans must cover outages and data theft together, as these bank attacks caused both.","System monitoring tuned for automated attack behaviour helps detect AI agents probing and exploiting bank infrastructure.","Banks processing client data must apply security appropriate to the risk, which now includes AI-accelerated attacks like this one.","Access enforcement on banking systems ensures that even automated attackers cannot reach card data without proper authorisation.","Least privilege and strong access control make it harder for automated AI agents to move from an initial foothold to client data.","AI risk policies should address the misuse of AI agents and penetration suites, the dual-use risk shown by this campaign.","Network monitoring can spot the scanning and lateral movement patterns that AI penetration suites like ARTEX generate at scale.","Exposure of client data requires notifying the authority promptly, as these bank breaches did.","Regular review of audit records helps detect AI-driven intrusions faster, before client data and card information are exfiltrated.","Restricting access to cardholder data by business need limits what an automated intruder can reach after initial access.","Logging and monitoring all access to cardholder systems helps detect AI-driven attackers reaching card data."]