The CrowdStrike Intelligence report reveals that a Chinese-speaking threat actor weaponized ARTEX, an open-source AI penetration testing tool, alongside Claude Agents and other LLMs to breach at least seven South Korean financial institutions, compromising roughly 68,000 records.
What’s notable: ARTEX was open-sourced on July 26 and deployed in active breaches by early October. The developer closed-sourced the repository on October 8, the same day CrowdStrike linked it to the campaign.
Claude’s inclusion raises immediate questions about API-level abuse detection. The threat actor may have accessed Claude through unofficial channels, but Anthropic hasn’t confirmed whether legitimate API usage was involved or whether its monitoring systems flagged the coordinated LLM calls in this financial attack.
Sources: Unknown Threat Actor Uses ARTEX to Target South Korean Finance
Coverage: Hacker Used ARTEX AI and Claude Agents to Target South Korean Banks • ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Related on this blog: [AUTO] The Exploit Window Collapsed • [AUTO] When Open Weights Enable Exploit Generation • [AUTO] Claude helped build an exploit chain against OpenAI