ARTEX Operator Uses Claude Code, DeepSeek, GLM and Grok to Target South Korean Banks
A financially motivated, likely Chinese-speaking threat actor conducted a data-theft campaign against South Korean financial organizations between late September and early October 2026, using the ARTEX operator console alongside Claude Code as an agent harness routed through alternative LLM backends. CrowdStrike first investigated the campaign on October 7, 2026, with moderate confidence attributing it to a financially motivated, Chinese-speaking operator; the group remains unattributed to a named actor. Compromised systems reportedly included a loan progress inquiry service for financial brokers and an employee mobile work-support platform, though the initial access vector is undisclosed. Hunt.io expanded the infrastructure picture via an exposed Hong Kong-hosted directory, revealing scripts, model-routing shims, proxy infrastructure, and staged JNDI/LDAP exploitation tooling.
Detalhes técnicos
Recovered credential files and shell scripts reference 38.244.50[.]120, identified in a .secrets file as JUMPHOST with root-account credentials and API access fields, matching CrowdStrike's prior ARTEX server identification. A separate exposed directory at 23.248.226[.]250:18099 (Hong Kong) contained 42 files, including local-boot.sh, tunnel-watchdog.sh, and sync-memory.sh, which use sshpass to maintain reverse SSH tunnels and sync Markdown memory files between systems. Recovered .claude.json metadata shows 510 Claude Code startups and 19 custom skills totaling 147 invocations, but the agent's model routing pointed to DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 and Grok 4.6, likely proxied through xcai[.]pro. Supporting shims ds-models-shim.py and xcai-effort-shim.py adapt the Claude Code interface to these nonstandard backends. Custom skills cover reconnaissance, source auditing, JavaScript API discovery, authentication testing, firewall bypass, payment logic, and Android cloud-phone operations. Proxy-enumeration scripts targeted 154.201.79[.]246:443, also listed in CrowdStrike's indicators; one sample identified 79 unique exit addresses across 100 tested identities. A staged JNDI/LDAP exploitation setup was also found, designed to execute system-identification commands and exfiltrate results via DNS callbacks, alongside cryptocurrency withdrawal scripts, Linux privilege-escalation builds, iOS research code, and Android firmware utilities of unconfirmed relevance to the banking intrusions.
Remediação
The Cloud Security Alliance cautions that neither full attack autonomy nor a reconciled victim count has been established. Defenders are advised to review peripheral application access, enforce server-side authorization, investigate unexplained outbound connections to model resellers and proxy services, and pivot on ARTEX console titles, certificate metadata, and the published infrastructure indicators without assuming automatic attribution for matching deployments.
Linha do tempo
-
ARTEX Operator Uses Claude Code, DeepSeek, GLM and Grok to Target South Korean Banks
ler a análise desta fonte ocultar
A financially motivated, likely Chinese-speaking threat actor conducted a data-theft campaign against South Korean financial organizations between late September and early October 2026, using the ARTEX operator console alongside Claude Code as an agent harness routed through alternative LLM backends. CrowdStrike first investigated the campaign on October 7, 2026, with moderate confidence attributing it to a financially motivated, Chinese-speaking operator; the group remains unattributed to a named actor. Compromised systems reportedly included a loan progress inquiry service for financial brokers and an employee mobile work-support platform, though the initial access vector is undisclosed. Hunt.io expanded the infrastructure picture via an exposed Hong Kong-hosted directory, revealing scripts, model-routing shims, proxy infrastructure, and staged JNDI/LDAP exploitation tooling.
Technical Details
Recovered credential files and shell scripts reference 38.244.50[.]120, identified in a
.secretsfile as JUMPHOST with root-account credentials and API access fields, matching CrowdStrike's prior ARTEX server identification. A separate exposed directory at 23.248.226[.]250:18099 (Hong Kong) contained 42 files, includinglocal-boot.sh,tunnel-watchdog.sh, andsync-memory.sh, which usesshpassto maintain reverse SSH tunnels and sync Markdown memory files between systems. Recovered.claude.jsonmetadata shows 510 Claude Code startups and 19 custom skills totaling 147 invocations, but the agent's model routing pointed to DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 and Grok 4.6, likely proxied through xcai[.]pro. Supporting shimsds-models-shim.pyandxcai-effort-shim.pyadapt the Claude Code interface to these nonstandard backends. Custom skills cover reconnaissance, source auditing, JavaScript API discovery, authentication testing, firewall bypass, payment logic, and Android cloud-phone operations. Proxy-enumeration scripts targeted 154.201.79[.]246:443, also listed in CrowdStrike's indicators; one sample identified 79 unique exit addresses across 100 tested identities. A staged JNDI/LDAP exploitation setup was also found, designed to execute system-identification commands and exfiltrate results via DNS callbacks, alongside cryptocurrency withdrawal scripts, Linux privilege-escalation builds, iOS research code, and Android firmware utilities of unconfirmed relevance to the banking intrusions.Remediation
The Cloud Security Alliance cautions that neither full attack autonomy nor a reconciled victim count has been established. Defenders are advised to review peripheral application access, enforce server-side authorization, investigate unexplained outbound connections to model resellers and proxy services, and pivot on ARTEX console titles, certificate metadata, and the published infrastructure indicators without assuming automatic attribution for matching deployments.