[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f83cTX72riDqbanVRBwONdsN-OWz82JSzvJ26desCQ3U":3},{"article":4,"iocs":51,"watch_terms":63,"solutions":64,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8afc87e1-e3dc-4543-9d65-58207a7226f9","ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms","artex-ai-pentesting-tool-used-in-data-theft-attacks-on-south-korean-financial-fi-50bd0e","Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration. \"In this activity, the threat actor leveraged","Cybersecurity researchers disclosed a targeted campaign against South Korean financial organizations using ARTEX, an open-source AI pentesting tool developed in China, from late September to early October 2026. The threat actor leveraged ARTEX alongside LLMs (DeepSeek, GLM-5.3, Grok 4.6) to conduct data exfiltration, with evidence pointing to a Chinese-speaking, financially motivated operator. Following the misuse, ARTEX developer Autumn-27 converted the tool to closed-source and ceased updates.","ARTEX AI pentesting tool used in data theft attacks on South Korean financial firms","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fartex-ai-pentesting-tool-used-in-data.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjrg8bHUppR3zYriUhWwJig9yJq8F69XCeJrtY040zk39DNhblhBRkcTcQSqRo6K3PwnMVoygOCmbWf2X7ySQDxpfDlgmXFBDGhoiicnG3_5E84RhV6muyzgGacKye5eiB5dLcvsNfny5yS-4TlrypAdPcU1PVfT-jMxWvdfg9algqsvxycUV1Jy1xUjGiT\u002Fs1600\u002Fai-hacker.jpg","2026-10-08T14:12:34+00:00","2026-10-08T16:00:11.298445+00:00",9,[17,20,22,25,27],{"name":18,"type":19},"CrowdStrike","vendor",{"name":21,"type":19},"Autumn-27",{"name":23,"type":24},"DeepSeek","technology",{"name":26,"type":24},"Claude",{"name":28,"type":29},"SCARLET LOOP","campaign","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":30,"icon":32,"name":33,"slug":34},null,"AI Security","ai-security",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60],{"type":53,"value":54,"context":55},"ip","38.244.50.120","IP address hosting ARTEX instance suspected to be behind attacks on Korean financial firms",{"type":57,"value":58,"context":59},"domain","xcai.pro","LLM API reseller likely used by threat actor to access DeepSeek",{"type":45,"value":61,"context":62},"ARTEX","Open-source agentic AI pentesting tool misused for data exfiltration attacks",[18,21],{"controls":65,"vendors":145},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":109,"vendor_name":18,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":124,"name":125,"problem":126,"products":127},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[128,129,137],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[146],{"slug":109,"name":18,"logo_path":110,"roles":147},[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"ai-pentesting-tool-artex-weaponized-against-south-korean-financial-firms","AI Pentesting Tool ARTEX Weaponized Against South Korean Financial Firms","Threat actors exploited ARTEX, an open-source AI-powered pentesting tool, to conduct targeted data exfiltration attacks against South Korean financial institutions, augmenting the attack with large language models to enhance effectiveness. The root cause lies in the inherent dual-use risk of open-source offensive security tooling — capabilities designed for legitimate penetration testing can be trivially repurposed by financially motivated adversaries. Financial organizations failed to detect or block the use of these AI-augmented exfiltration techniques in time to prevent data theft, highlighting gaps in behavioral monitoring and anomaly detection. This incident underscores that the proliferation of AI-enhanced offensive tools dramatically lowers the skill threshold for sophisticated attacks, making proactive supply chain vetting and robust data loss prevention controls critical for high-value targets.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 3 – Data Protection","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-4 – Information System Monitoring","NIST SP 800-53 AC-4 – Information Flow Enforcement","NIST SP 800-53 SA-12 – Supply Chain Protection","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF ID.SC-2 – Supplier and Third-Party Risk","MITRE ATT&CK T1567 – Exfiltration Over Web Service","MITRE ATT&CK T1588.002 – Obtain Capabilities: Tool","GDPR Article 32 – Security of Processing","ITIL Service Security Management – Threat & Risk Assessment",{"CIS Control 3 – Data Protection":167,"NIST CSF DE.CM-1 – Network Monitoring":168,"GDPR Article 32 – Security of Processing":169,"CIS Control 16 – Application Software Security":170,"NIST SP 800-53 SA-12 – Supply Chain Protection":171,"CIS Control 13 – Network Monitoring and Defense":172,"NIST CSF ID.SC-2 – Supplier and Third-Party Risk":173,"MITRE ATT&CK T1567 – Exfiltration Over Web Service":174,"MITRE ATT&CK T1588.002 – Obtain Capabilities: Tool":175,"NIST SP 800-53 AC-4 – Information Flow Enforcement":176,"NIST SP 800-53 SI-4 – Information System Monitoring":177,"ITIL Service Security Management – Threat & Risk Assessment":178},"Data protection controls limit the sensitive financial data available for ARTEX-driven exfiltration.","Network monitoring helps detect unusual outbound transfers.","Requires appropriate security for financial customer data.","Application security covers understanding how dual-use tools like ARTEX can be misused.","Supply chain protection covers evaluating risks of open source tools.","Network monitoring can detect the data exfiltration ARTEX enabled.","Third-party risk management covers open source tools that can be weaponised.","Describes exfiltration over web services, a likely route for stolen financial data.","Describes attackers obtaining tools like ARTEX for their operations.","Information flow enforcement limits where data can be sent, hindering exfiltration.","System monitoring can detect pentesting tools used by unauthorised parties.","Threat and risk assessment helps anticipate the misuse of dual-use AI tools."]