🔴 AI-Driven tool ARTEX used in attacks against South Korean Banks

CrowdStrike analyzes open directories left by an attacker who used the ARTEX AI pentest tool and LLMs to breach South Korean financial firms.

CrowdStrike published a research on a campaign against South Korean financial organizations that ran from late September to early October 2026 and ended with stolen data. The attacker left their working notes where anyone could read them.

Open directories on servers controlled by the attacker exposed Claude Code session histories, ARTEX configuration files, and Claude memory files. Researchers could see how the operator worked, prompt by prompt. That is rare, and it makes this report particularly interesting.