Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

CrowdStrike Intelligence identified a late-September to early-October 2026 campaign targeting South Korean financial organizations in which a financially motivated, likely Chinese-speaking threat actor used the open-source agentic pentesting tool ARTEX alongside multiple LLM backends (DeepSeek, GLM-5.3, Grok) to conduct intrusions and exfiltrate data; analysis of exposed open directories produced Claude Code session histories, ARTEX configuration and memory files, and IoCs (notably IPs such as 38.244.50.120 and several proxy addresses), and the report highlights how agentic AI tooling is being integrated into adversary tradecraft.