This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A financially motivated threat actor leveraged the agentic AI pentesting tool ARTEX alongside LLMs including DeepSeek, GLM, Grok, and Claude Code to conduct a targeted cyberattack campaign against South Korean financial organizations, resulting in exfiltrated data.
An unidentified attacker reportedly used ARTEX, an AI-powered security-testing tool, alongside large language models to breach South Korean financial institutions and steal data. Compromised systems included a loan-broker inquiry service and an employee mobile work-support system. Researchers linked the activity to exposed attacker infrastructure and AI session histories. The attacker’s identity and the full number of affected institutions remained unconfirmed.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The cyberattacks resulted in data breaches and the exfiltration of non-public financial and customer data from South Korean banks.
The threat actor used agentic AI tools and LLMs to conduct targeted cyberattacks against South Korean financial institutions, exfiltrating sensitive data.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated and executed by a human threat actor who intentionally used AI systems to conduct cyberattacks and exfiltrate data.
A financially motivated cyberattack campaign successfully targeted South Korean financial institutions using the agentic AI tool ARTEX and multiple LLMs. The incident highlights an evolved capability where malicious actors leverage AI agents to automate and accelerate data exfiltration, posing substantial risks to economic and technological security.
The threat actor leveraged ARTEX, which is described as an 'open-source agentic penetration testing tool' that uses LLMs to autonomously conduct pentesting activities based on a prompt, exhibiting goal-directed planning and execution.
Limited Risk: The AI systems utilized (DeepSeek, GLM, Grok, Claude Code) are general-purpose large language models and code assistants, which function as chatbots and interactive tools, falling under the Limited Risk category.
The threat actor primarily used Claude Code and ARTEX to generate and execute code/commands for penetration testing, and used LLMs for question answering regarding where to sell the exfiltrated data.
The report from CrowdStrike provides highly detailed technical indicators, including specific IP addresses, tool configurations, and session histories. The role of the AI systems and the nature of the cyberattack are clearly documented, leaving little ambiguity about the technical execution.
None. The incident is clearly a malicious cyberattack facilitated by agentic AI tools.
Technology
Agentic Pentesting Tool Availability
Open-source agentic tool ARTEX enabled automated offensive operations.
Dual-Use LLM Capabilities
LLMs like DeepSeek and Grok were used for offensive cyber operations.
API Proxy Bypass of Controls
API reseller xcai.pro allowed access to LLMs bypassing standard safety filters.
Data Inputs
Malicious Prompts
Chinese-language pentesting prompts guided the LLMs to execute attacks.
Lack of Input Safety Filtering
LLM inputs did not block requests for finding stolen data sales channels.
Session History Exposure
Claude Code session histories and memory files were left in open directories.
Human Factors
Malicious Intent of Operator
Financially motivated attacker leveraged AI to accelerate intrusion tempo.
Abuse of Coding Assistants
Attacker used Claude Code to assist in vulnerability research.
Process and Methods
Inadequate API Access Controls
Lack of robust verification by API resellers allowed malicious access.
Lack of AI Output Guardrails
AI models provided actionable advice on where to sell exfiltrated data.
Management
Inadequate API Partner Monitoring
LLM providers failed to block abusive API resellers like xcai.pro.
Regulatory Environment
Unregulated Open-Source AI Tools
No regulations restricted the release of agentic pentesting tools like ARTEX.
Lack of API Reseller Oversight
API proxies operate with minimal regulatory oversight, enabling abuse.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
