Hunt.io maps ARTEX AI pentest infrastructure behind breaches at seven South Korean financial institutions
Between late September and early October 2026, seven South Korean financial institutions suffered data breaches through internet-facing systems, exposing personal, employment, income and loan data on roughly 66,000–67,000 individuals and about 2,200 corporations. Hunt.io traced the infrastructure behind the campaign, building on earlier reporting from CrowdStrike (October 7) and Genians Security Center (October 12), both of which attributed the activity to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established group. The campaign ran several large language models — DeepSeek v4.1 Flash as the primary, with GLM 5.3 and Grok 4.6 as backups — reached in part through the reseller domain xcai[.]pro. Hunt.io notified the relevant national CERT before publication and states its report contains no personal records or credentials.
Detalhes técnicos
The known public infrastructure was a two-server setup: a Hong Kong IP used as primary infrastructure and 38.244.50[.]120, hosting the ARTEX console. Hunt.io's scanning placed 38.244.50[.]120 on Cogent's network in Los Angeles with 15 open ports, the ARTEX login page (Chinese title meaning "autonomous penetration testing console") on ports 443 and 8090, alongside a Gemini2API admin console and a Tinyproxy server. Pivoting in its AttackCapture platform surfaced an open directory on a Hong Kong jump server at 23.248.226[.]250 (AS138415), 42 files across 2 subdirectories totalling 105 MB, with warnings logged on September 5, September 26 and October 5; scripts there maintained reverse SSH tunnels (one named grok2api), ran a local relay and copied files to the jump host, and a credentials file held keys for Zhipu AI GLM models, an OpenAI-compatible relay and a proxy service.
The operator's agent harness was Claude Code version 2.1.221, launched 510 times since August 4, but routed away from Anthropic: ds-models-shim.py intercepts the /v1/models request (which returns 404 against a non-Anthropic backend) and returns a local list containing deepseek-v4-pro and deepseek-flash, forwarding everything else to api.deepseek.com/anthropic, while xcai-effort-shim.py injects a reasoning setting the DeepSeek backend otherwise skips. The chain runs Claude Code → Claude Code Router → xcai → DeepSeek. A state file recorded 19 custom skills with 147 uses, covering code audit, reconnaissance, web injection, WAF bypass, authentication testing, Telegram Mini Apps, APK download and decompilation, cloud phone control and payment logic testing; three self-registered test accounts with cash-in deposit API tokens dated September 12 fit testing for insecure direct object reference (IDOR) flaws, the technique CrowdStrike and Genians described against Korean loan and inquiry services. Other tooling included a FOFA query script using a backup API key, proxy enumeration against a rotating service at 154.201.79[.]246:443 (79 unique exit IPs in the first 100 identities), and a staged JNDI/LDAP exploitation kit at 23.248.226[.]250:8001 retrieved on October 5 at 03:42 UTC that confirmed command execution via DNS callback. Files aimed at a cryptocurrency exchange's admin session and withdrawals, Linux privilege escalation exploits, iOS probe source and Android kernel/firmware utilities were also recovered, though Hunt.io says their link to the Korean breaches is unconfirmed.
Hunting ARTEX more broadly, a certificate-issuer search returned 19 IPs including 38.244.50[.]120, a malware-classification search returned 1,303 addresses across 30 countries (led by the United States, China and Hong Kong — registration locations, not operator location), and a page-title search returned about 1,300 IPs with 19 likely consoles in seven languages. Among 280 open-directory results were 130.94.31[.]86:18888 in Seoul and 156.251.11[.]39, holding an SMB reconnaissance toolkit whose test script writes artex_probe_11876.txt; other hosts carried DedeCMS and FangCMS exploitation kits, a CAPTCHA bypass suite and a RuoYi/Spring administrative console exploit, indicating many operators are adopting the framework. Genians reported the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain.
Remediação
Remove public access to administrative services and place them behind VPNs or allowlists; reset SSH passwords and rotate API keys, proxy credentials and tokens potentially exposed through open directories. Patch internet-facing services, monitor for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Restrict and monitor access to model gateways and enforce compliance rules on managed mobile devices.
Linha do tempo
-
Hunt.io maps ARTEX AI pentest infrastructure behind breaches at seven South Korean financial institutions
ler a análise desta fonte ocultar
Between late September and early October 2026, seven South Korean financial institutions suffered data breaches through internet-facing systems, exposing personal, employment, income and loan data on roughly 66,000–67,000 individuals and about 2,200 corporations. Hunt.io traced the infrastructure behind the campaign, building on earlier reporting from CrowdStrike (October 7) and Genians Security Center (October 12), both of which attributed the activity to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established group. The campaign ran several large language models — DeepSeek v4.1 Flash as the primary, with GLM 5.3 and Grok 4.6 as backups — reached in part through the reseller domain xcai[.]pro. Hunt.io notified the relevant national CERT before publication and states its report contains no personal records or credentials.
Technical Details
The known public infrastructure was a two-server setup: a Hong Kong IP used as primary infrastructure and 38.244.50[.]120, hosting the ARTEX console. Hunt.io's scanning placed 38.244.50[.]120 on Cogent's network in Los Angeles with 15 open ports, the ARTEX login page (Chinese title meaning "autonomous penetration testing console") on ports 443 and 8090, alongside a Gemini2API admin console and a Tinyproxy server. Pivoting in its AttackCapture platform surfaced an open directory on a Hong Kong jump server at 23.248.226[.]250 (AS138415), 42 files across 2 subdirectories totalling 105 MB, with warnings logged on September 5, September 26 and October 5; scripts there maintained reverse SSH tunnels (one named grok2api), ran a local relay and copied files to the jump host, and a credentials file held keys for Zhipu AI GLM models, an OpenAI-compatible relay and a proxy service.
The operator's agent harness was Claude Code version 2.1.221, launched 510 times since August 4, but routed away from Anthropic: ds-models-shim.py intercepts the
/v1/modelsrequest (which returns 404 against a non-Anthropic backend) and returns a local list containing deepseek-v4-pro and deepseek-flash, forwarding everything else to api.deepseek.com/anthropic, while xcai-effort-shim.py injects a reasoning setting the DeepSeek backend otherwise skips. The chain runs Claude Code → Claude Code Router → xcai → DeepSeek. A state file recorded 19 custom skills with 147 uses, covering code audit, reconnaissance, web injection, WAF bypass, authentication testing, Telegram Mini Apps, APK download and decompilation, cloud phone control and payment logic testing; three self-registered test accounts with cash-in deposit API tokens dated September 12 fit testing for insecure direct object reference (IDOR) flaws, the technique CrowdStrike and Genians described against Korean loan and inquiry services. Other tooling included a FOFA query script using a backup API key, proxy enumeration against a rotating service at 154.201.79[.]246:443 (79 unique exit IPs in the first 100 identities), and a staged JNDI/LDAP exploitation kit at 23.248.226[.]250:8001 retrieved on October 5 at 03:42 UTC that confirmed command execution via DNS callback. Files aimed at a cryptocurrency exchange's admin session and withdrawals, Linux privilege escalation exploits, iOS probe source and Android kernel/firmware utilities were also recovered, though Hunt.io says their link to the Korean breaches is unconfirmed.Hunting ARTEX more broadly, a certificate-issuer search returned 19 IPs including 38.244.50[.]120, a malware-classification search returned 1,303 addresses across 30 countries (led by the United States, China and Hong Kong — registration locations, not operator location), and a page-title search returned about 1,300 IPs with 19 likely consoles in seven languages. Among 280 open-directory results were 130.94.31[.]86:18888 in Seoul and 156.251.11[.]39, holding an SMB reconnaissance toolkit whose test script writes
artex_probe_11876.txt; other hosts carried DedeCMS and FangCMS exploitation kits, a CAPTCHA bypass suite and a RuoYi/Spring administrative console exploit, indicating many operators are adopting the framework. Genians reported the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain.Remediation
Remove public access to administrative services and place them behind VPNs or allowlists; reset SSH passwords and rotate API keys, proxy credentials and tokens potentially exposed through open directories. Patch internet-facing services, monitor for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Restrict and monitor access to model gateways and enforce compliance rules on managed mobile devices.