ARTEX AI pentest framework with Claude Code on DeepSeek, GLM and Grok backends used to breach seven South Korean financial institutions

Linha do tempo

1. securityaffairs.com ↗ · pub. 07/11/2026 16:56 · coletado 07/11 18:00

   Hunt.io maps ARTEX AI pentest infrastructure behind breaches at seven South Korean financial institutions

   ler a análise desta fonte ocultar

   Between late September and early October 2026, seven South Korean financial institutions suffered data breaches through internet-facing systems, exposing personal, employment, income and loan data on roughly 66,000–67,000 individuals and about 2,200 corporations. Hunt.io traced the infrastructure behind the campaign, building on earlier reporting from CrowdStrike (October 7) and Genians Security Center (October 12), both of which attributed the activity to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established group. The campaign ran several large language models — DeepSeek v4.1 Flash as the primary, with GLM 5.3 and Grok 4.6 as backups — reached in part through the reseller domain xcai[.]pro. Hunt.io notified the relevant national CERT before publication and states its report contains no personal records or credentials.

   Technical Details

   The known public infrastructure was a two-server setup: a Hong Kong IP used as primary infrastructure and 38.244.50[.]120, hosting the ARTEX console. Hunt.io's scanning placed 38.244.50[.]120 on Cogent's network in Los Angeles with 15 open ports, the ARTEX login page (Chinese title meaning "autonomous penetration testing console") on ports 443 and 8090, alongside a Gemini2API admin console and a Tinyproxy server. Pivoting in its AttackCapture platform surfaced an open directory on a Hong Kong jump server at 23.248.226[.]250 (AS138415), 42 files across 2 subdirectories totalling 105 MB, with warnings logged on September 5, September 26 and October 5; scripts there maintained reverse SSH tunnels (one named grok2api), ran a local relay and copied files to the jump host, and a credentials file held keys for Zhipu AI GLM models, an OpenAI-compatible relay and a proxy service.

   The operator's agent harness was Claude Code version 2.1.221, launched 510 times since August 4, but routed away from Anthropic: ds-models-shim.py intercepts the /v1/models request (which returns 404 against a non-Anthropic backend) and returns a local list containing deepseek-v4-pro and deepseek-flash, forwarding everything else to api.deepseek.com/anthropic, while xcai-effort-shim.py injects a reasoning setting the DeepSeek backend otherwise skips. The chain runs Claude Code → Claude Code Router → xcai → DeepSeek. A state file recorded 19 custom skills with 147 uses, covering code audit, reconnaissance, web injection, WAF bypass, authentication testing, Telegram Mini Apps, APK download and decompilation, cloud phone control and payment logic testing; three self-registered test accounts with cash-in deposit API tokens dated September 12 fit testing for insecure direct object reference (IDOR) flaws, the technique CrowdStrike and Genians described against Korean loan and inquiry services. Other tooling included a FOFA query script using a backup API key, proxy enumeration against a rotating service at 154.201.79[.]246:443 (79 unique exit IPs in the first 100 identities), and a staged JNDI/LDAP exploitation kit at 23.248.226[.]250:8001 retrieved on October 5 at 03:42 UTC that confirmed command execution via DNS callback. Files aimed at a cryptocurrency exchange's admin session and withdrawals, Linux privilege escalation exploits, iOS probe source and Android kernel/firmware utilities were also recovered, though Hunt.io says their link to the Korean breaches is unconfirmed.

   Hunting ARTEX more broadly, a certificate-issuer search returned 19 IPs including 38.244.50[.]120, a malware-classification search returned 1,303 addresses across 30 countries (led by the United States, China and Hong Kong — registration locations, not operator location), and a page-title search returned about 1,300 IPs with 19 likely consoles in seven languages. Among 280 open-directory results were 130.94.31[.]86:18888 in Seoul and 156.251.11[.]39, holding an SMB reconnaissance toolkit whose test script writes artex_probe_11876.txt; other hosts carried DedeCMS and FangCMS exploitation kits, a CAPTCHA bypass suite and a RuoYi/Spring administrative console exploit, indicating many operators are adopting the framework. Genians reported the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain.

   Remediation

   Remove public access to administrative services and place them behind VPNs or allowlists; reset SSH passwords and rotate API keys, proxy credentials and tokens potentially exposed through open directories. Patch internet-facing services, monitor for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Restrict and monitor access to model gateways and enforce compliance rules on managed mobile devices.

2. gbhackers.com ↗ · pub. 05/11/2026 08:14 · coletado 05/11 10:00 primeiro registro

   ARTEX Operator Uses Claude Code, DeepSeek, GLM and Grok to Target South Korean Banks

   ler a análise desta fonte ocultar

   A financially motivated, likely Chinese-speaking threat actor conducted a data-theft campaign against South Korean financial organizations between late September and early October 2026, using the ARTEX operator console alongside Claude Code as an agent harness routed through alternative LLM backends. CrowdStrike first investigated the campaign on October 7, 2026, with moderate confidence attributing it to a financially motivated, Chinese-speaking operator; the group remains unattributed to a named actor. Compromised systems reportedly included a loan progress inquiry service for financial brokers and an employee mobile work-support platform, though the initial access vector is undisclosed. Hunt.io expanded the infrastructure picture via an exposed Hong Kong-hosted directory, revealing scripts, model-routing shims, proxy infrastructure, and staged JNDI/LDAP exploitation tooling.

   Technical Details

   Recovered credential files and shell scripts reference 38.244.50[.]120, identified in a .secrets file as JUMPHOST with root-account credentials and API access fields, matching CrowdStrike's prior ARTEX server identification. A separate exposed directory at 23.248.226[.]250:18099 (Hong Kong) contained 42 files, including local-boot.sh, tunnel-watchdog.sh, and sync-memory.sh, which use sshpass to maintain reverse SSH tunnels and sync Markdown memory files between systems. Recovered .claude.json metadata shows 510 Claude Code startups and 19 custom skills totaling 147 invocations, but the agent's model routing pointed to DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 and Grok 4.6, likely proxied through xcai[.]pro. Supporting shims ds-models-shim.py and xcai-effort-shim.py adapt the Claude Code interface to these nonstandard backends. Custom skills cover reconnaissance, source auditing, JavaScript API discovery, authentication testing, firewall bypass, payment logic, and Android cloud-phone operations. Proxy-enumeration scripts targeted 154.201.79[.]246:443, also listed in CrowdStrike's indicators; one sample identified 79 unique exit addresses across 100 tested identities. A staged JNDI/LDAP exploitation setup was also found, designed to execute system-identification commands and exfiltrate results via DNS callbacks, alongside cryptocurrency withdrawal scripts, Linux privilege-escalation builds, iOS research code, and Android firmware utilities of unconfirmed relevance to the banking intrusions.

   Remediation

   The Cloud Security Alliance cautions that neither full attack autonomy nor a reconciled victim count has been established. Defenders are advised to review peripheral application access, enforce server-side authorization, investigate unexplained outbound connections to model resellers and proxy services, and pivot on ARTEX console titles, certificate metadata, and the published infrastructure indicators without assuming automatic attribution for matching deployments.