[AUTO] ARTEX Attacker Exposed by Leftover Session Logs

A threat actor breached South Korean banks including Shinhan and KB Kookmin using ARTEX, an open-source AI pentesting tool, alongside DeepSeek, GLM, and Grok to compromise loan inquiry services and employee mobile work platforms. CrowdStrike found the attacker used Claude for reconnaissance, asking where Korean data is sold. What exposed them wasn’t tool sophistication; it was opsec failure.

The attacker left public directories with Claude Code sessions, ARTEX configs, memory files, and personal information identifying them as a 26-year-old from Guangdong. CrowdStrike traced approximately 68,000 records through these artifacts.

Chaining multiple tools creates multiple layers of logs and config. Securing all simultaneously is harder than securing one. This attacker optimized for each tool’s capability without accounting for aggregated risk of traces across platforms.

This isn’t a failure of ARTEX or Claude. It’s a failure of discipline integrating tools into an attack.

Sources: Unknown Threat Actor Uses ARTEX to Target South Korean Finance

Coverage: ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms • CrowdStrike finds possible bank hacker’s CV among exposed AI logs