South Korea Bank Hack: How ARTEX, LLMs and Claude Code Sessions Exposed the Attacker

Last week, several of South Korea's largest financial organizations reported data breaches. On October 7, 2026, CrowdStrike Intelligence published Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, saying the campaign was probably run by one person using an open-source agentic pentesting tool called ARTEX plus a rotating set of LLMs, including Claude Code. What gave the actor away was not a sophisticated defender. It was an open web directory on his own server.

This post summarizes what CrowdStrike reported about the South Korea bank cyberattack, separates what is confirmed from what is assessed, and pulls out what matters for anyone running AI coding agents. Everything attributed to the campaign below comes from CrowdStrike's report and the news coverage it cites; Beam has no independent visibility into these incidents.

TL;DR: the South Korea bank hack at a glance

How the attack worked

According to industry reports cited by CrowdStrike, the attacker went after two kinds of internal-facing systems: a loan progress inquiry service that brokers use to check on applications, and a mobile work-support system for bank employees. Activity at several organizations reportedly involved overlapping IP addresses, which is part of why investigators suspected a single operator.

The ARTEX link came from HTML files on a reportedly attacker-controlled server that referenced the string "ARTEX". CrowdStrike then followed that infrastructure to an IP address, 38.244.50[.]120, which hosted an ARTEX instance and a browsable directory.

What ARTEX is

ARTEX is an agentic penetration-testing tool: instead of a human stepping through a scanner, an LLM is given a goal and a system prompt, and it chooses and runs the tooling itself. Pentesting agents are legitimate security tools. The same property that makes them useful for red teams — they chain recon, exploitation and follow-up with little supervision — shortens the time an attacker needs per target.

CrowdStrike's assessment is blunt about the effect: the activity "demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span."

The two-server layout

Claude Code sessions recovered from the exposed directories show two servers with different jobs:

1. A Hong Kong–based IP address served as the attacker's primary infrastructure, and hosted additional open directories with Claude Code session histories, ARTEX configuration files and Claude memory files.
2. 38.244.50[.]120 hosted the ARTEX instance that was likely responsible for the Korean attacks.

The ARTEX instance used DeepSeek v4.1-flash as its main LLM backend. The actor added GLM-5.3 and Grok 4.6 for further Claude Code sessions, and likely reached DeepSeek through an LLM API proxy or reseller, xcai[.]pro. A Chinese-language pentesting prompt in /.claude/CLAUDE.md told the model how to conduct the testing.

The operational security mistake

Directory listing was enabled on a server that held the actor's working files. That one setting exposed:

• CLAUDE.md — standing instructions that shaped how the agent behaved, including the pentesting prompt.
• Session histories — the full conversation and tool-call record, which is why CrowdStrike could reconstruct the campaign timeline.
• Memory files — what the agent had been told to remember between sessions.
• ARTEX configuration — how the tool was wired to its model backends.

Per CrowdStrike, the sessions also show the actor asking Claude where threat actors typically sell Korean data breach information and for help finding Korean Telegram data-sales groups, and asking Claude to draft a security-researcher résumé that cited the ARTEX activity as results. That résumé prompt contained personal details that CrowdStrike says likely belong to the operator but cannot definitively tie to him. Because those details are unconfirmed and relate to a private individual, this post does not repeat them.

Timeline and scale, per Korean reporting

CrowdStrike's report names no banks and gives no record counts. The Kyunghyang Shinmun's English-language report of October 4, which CrowdStrike cites, fills in the local picture. It is a secondary source, translated by an AI tool, and based on statements from the financial authorities and industry, so treat its figures as reported rather than audited.

According to that report:

• Dates. Between September 27 and 30, information was leaked through external intrusions at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank and Hyundai Capital. The paper also reports that more than 2,200 corporate customer records were leaked at Welcome Savings Bank, and that two online investment-linked finance companies suffered data leaks.
• Scale. At Shinhan Bank, 25,727 items of personal information were taken, including names, contact details, annual income and loan limits. At Kookmin Bank and Hana Bank, the figures were 119 and 89 customers.
• Which systems. The attackers went after relatively weaker internal systems rather than customer internet and mobile banking. At Shinhan it was the loan-progress inquiry service used by loan brokers. At Kookmin it was an internal mobile work-support system for employees.
• Method. The authorities presume an AI-automated brute-force approach. The attackers reportedly entered random values into the broker service at Shinhan to find valid customer numbers, then extracted further details such as contact information. The authorities read the pattern as automated probing across many firms, with the weaker ones breached, not a strike on chosen targets.
• Identification of the tool. Moon Jong-hyun of the Genians Security Center wrote on October 2 that the HTML title of web servers used in the attacks contained the string "ARTEX-自主渗透試控制台", which the article translates as "autonomous penetration test console." That string is the reference CrowdStrike's summary mentions.
• ARTEX's age. The article says ARTEX was released on GitHub on July 26, that its latest version came out on September 24, and that the attack on Kookmin Bank began three days later, on September 27.

The Financial Services Commission held an emergency meeting across the sector on October 4, and the paper reports that Korea's president called for a thorough investigation. Beam cannot verify any of this independently. It matters here because it shows what kind of target an agentic scanner finds: peripheral systems with weaker authentication. Stealien's CEO is quoted as saying the main financial systems held because they require authentication beyond IDs and passwords, and that peripheral systems did not.

What CrowdStrike says about the attacker's own agent use

The story has an unusual layer. The actor used coding agents as a working environment, not only a pentest tool. CrowdStrike's description of the recovered sessions gives a view of that use:

• A standing prompt in /.claude/CLAUDE.md told the model how to conduct testing. It was written in Chinese, and the file also contained the Hong Kong IP address that led CrowdStrike to the second server.
• The sessions ran against more than one model. The ARTEX instance used DeepSeek v4.1-flash as the primary backend, and the actor added GLM-5.3 and Grok 4.6 "for additional Claude Code sessions."
• The actor reached DeepSeek through what CrowdStrike calls a likely API proxy or reseller. Routing through a reseller is a common way to get access to a model without a direct account, and it also means a third party sits in the path of the prompts.
• The actor also used Claude for tasks outside intrusion: asking where Korean breach data is sold, asking for help finding Korean Telegram data-sales groups, and asking for a security researcher résumé. BleepingComputer's report adds that the records showed no specific plan to monetize the stolen data.

Indicators of compromise

CrowdStrike lists these network indicators. Defenders at financial institutions may want to check them against logs; they are listed defanged.

CrowdStrike maps the activity to MITRE ATT&CK techniques T1583.003 (Acquire Infrastructure: Virtual Private Server), T1588.007 (Obtain Capabilities: Artificial Intelligence) and T1090 (Proxy).

Update (October 20, 2026): ARTEX goes closed-source

BleepingComputer's October 10 follow-up reports that after confirming ARTEX had been used in real-world attacks, its developer made the project closed-source and discontinued further updates. It adds that the project's last public code has been used to build English- and Korean-language derivatives, so the tool remains available in that form. The GitHub address for the repository, github.com/Autumn-27/ARTEX, returned a 404 when Beam checked on October 20, which is consistent with the removal but does not by itself confirm the details of the developer's decision.

For defenders, the practical reading is that withdrawing the original repository does not remove the capability. Derived copies exist, and the technique they automate, random-value probing of peripheral services for valid identifiers, does not depend on one project. CrowdStrike's indicators remain the specific signal to search for. Whether the number of affected organizations has changed since CrowdStrike wrote that it was unconfirmed is not clear from the sources Beam read, so the figure in this post stays attributed to the October 4 and October 7 reports.

What this means if you run AI coding agents

The story is about an attacker, but three lessons apply to ordinary users of Claude Code, Codex and similar agents.

1. Agent session data is a rich, sensitive artifact

A session history is a complete record of intent, commands, file contents and sometimes credentials pasted into prompts. In this case it let a third party rebuild a campaign. In your case it could reveal internal hostnames, tokens or customer data. Treat ~/.claude, project CLAUDE.md files and memory files like you treat shell history and .env files: never serve them over HTTP, never commit them to public repositories, and never leave directory listing on for a path that contains them.

How to check whether your own session data is exposed

The open directory is the part of this story you can test against yourself. These checks are generic web-server hygiene, not steps from CrowdStrike's report:

1. Find the files. Agent state usually lives in your home directory (~/.claude for Claude Code) and in project folders (CLAUDE.md, memory files). Locate them before you decide where they may sit.
2. Check what a web server serves. If you run a static file server or a dev server from a directory, confirm it does not serve a parent directory that contains those files, and that directory listing is off.
3. Check from outside. Request the path from a machine that is not on your network and confirm you get an error, not a listing.
4. Keep them out of version control. Check .gitignore and your repository history for session exports and memory files.
5. Rotate anything that was in a prompt. If a token or password was ever pasted into a session whose file may have been exposed, treat it as exposed.

The attacker's mistake was ordinary. The surprise is how much a session history holds: the prompts, the tool output and the intent, in order.

2. Agents lower the cost of scale

CrowdStrike expects adversaries "will likely continue to experiment with implementing AI tooling in their operations to enhance their operational tempo and capabilities." That matches the pattern in Anthropic's September 2026 threat intelligence report and cases such as ShinyHunters-style vibe hacking. Defenders should assume more attempts per attacker, not smarter individual exploits.

3. Know what your own agents are doing

The flip side of attackers using agents is that your own agents can be steered or misused too — see AI agent security incidents: a timeline and agents harvesting credentials into a loot folder. A local record of tool calls makes it possible to answer "what did the agent actually run?" after the fact. That is the job of AI agent monitoring, and the trade-offs between watching and blocking are covered in monitor vs. block.

What developers are saying

The Hacker News thread on Reuters' report of the Korean president's comments drew about a hundred points. Two comments add something beyond the headline.

• jdw64 reported reading that some Korean banks were not affected because they restrict work access to designated tablets, and do not give loan recruiters access to the internal network or a separate work system. In this commenter's account, a convenience feature for brokers became the attack surface. This is a commenter's report, not something Beam has verified, but it matches the reporting above that the peripheral broker and employee systems were the ones breached.
• tangotaylor asked what evidence showed that AI agents were used and which ones. CrowdStrike's report, published October 7, supplies an answer: the attacker's own open directories.

What Beam can and cannot do here

Beam is a local, privacy-first console that watches coding agent activity and flags actions such as credential exposure and destructive commands. Stated plainly:

• Beam does not detect ARTEX or stop attackers. It watches agents on your own machine; it has no view of an attacker's infrastructure or of bank-side intrusions.
• It is relevant to the exposure lesson. Beam stores events as local NDJSON in a directory with mode 0700, redacts known credential formats before writing to disk, and sends nothing off-device by default. It does not protect you if you separately publish your own files with a web server.
• Enforcement is limited. Workspace enforce denies matching Claude Code and Codex tool calls through hooks; it is not a kernel sandbox, and missing or expired cached policy is fail-open.

For practical hardening of your own setup, see stopping dangerous commands in Claude Code and the MCP security practical guide.

Frequently asked questions

What happened in the South Korean bank cyberattack?

Beginning in late September 2026, several South Korean financial organizations suffered data breaches. Industry reporting says one attacker breached a loan progress inquiry service used by financial brokers at one bank, and an employee mobile work-support system at another. The number of affected organizations is still unconfirmed.

What is ARTEX?

ARTEX is a recently released, open-source agentic penetration testing tool developed in China. CrowdStrike says the threat actor ran an ARTEX instance backed by LLMs, with DeepSeek v4.1-flash as the primary model.

How was the attacker's activity discovered?

CrowdStrike found open web directories on attacker-controlled servers. They exposed a Claude Code CLAUDE.md file, session histories, ARTEX configuration files and Claude memory files, which documented the campaign from late September to early October 2026.

Has the attacker been identified?

Not definitively. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated, but has not attributed the activity to a named adversary. Personal details in one prompt likely belong to the actor, but CrowdStrike says current information cannot definitively associate them with him.

Does this mean Claude Code is unsafe to use?

No. Claude Code was one of several tools the actor used, alongside ARTEX and other LLMs. The lesson for ordinary users is about the data agents accumulate — session histories, memory files, prompts — and what happens when a directory holding it is served publicly.

Related reading: Microsoft's Storm-0940 report on ARTEX in the ConnectWise attack, Anthropic's report on Russian espionage using Claude, Wiz's account of an AI-run cloud intrusion and what Reuters verified about agents breaching 100+ sites.

Details reflect CrowdStrike Intelligence's report published October 7, 2026, and news coverage it cites, as of October 8, 2026. Attribution and the number of affected organizations may change as investigations continue.