ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
ID: 44ab0e87-142d-5f54-ab78-094e4e6ce4da
STIX ID: report--44ab0e87-142d-5f54-ab78-094e4e6ce4da
Feed Name: GBHackers
Threat Score
A financially motivated operator leveraged AI tooling (ARTEX, Claude Code, and multiple LLM backends such as DeepSeek/GLM/Grok) to support intrusions against South Korean financial organizations; exposed directories, session histories, scripts, credentials, and IOCs (notably 38.244.50.120, 23.248.226.250, 154.201.79.246, and xcai.pro) indicate data theft occurred in late September–early October 2026, though attribution to a named group is not established and some links remain unconfirmed.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.