POLICY · MODELS · #1707
AI-powered ARTEX used in likely single-attacker breach of multiple South Korean banks
CrowdStrike reports a suspected Chinese-speaking attacker breached multiple South Korean financial institutions between late September and early October 2026, stealing large volumes of customer data (Shinhan Bank reportedly lost over 25,000 records, per Khan). Researchers say the attacker used ARTEX—an open-source AI automated-penetration-testing tool leveraging DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6—and left Claude Code session logs that indicate attempts to market stolen data.
KEY POINTS
- CrowdStrike reports a suspected Chinese-speaking attacker breached multiple South Korean financial institutions between late September and early October 2026, stealing large volumes of customer data (Shinhan Bank reportedly lost over 25,000 records, per Khan).
- Researchers say the attacker used ARTEX—an open-source AI automated-penetration-testing tool leveraging DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6—and left Claude Code session logs that indicate attempts to market stolen data.
- The incident illustrates how AI-driven offensive tools can enable a single actor to execute large, fast breaches, raising urgent systemic cyber-risk concerns.
WHY IT MATTERS
The incident illustrates how AI-driven offensive tools can enable a single actor to execute large, fast breaches, raising urgent systemic cyber-risk concerns.