ARTEX Hackers Expose Their Own Servers, Revealing AI Tools Behind South Korean Bank Breaches

A hacker’s own mistake has given researchers a rare look at how AI tools were used to break into South Korean financial firms. The operator left several servers open to the public, and the exposed files showed which AI models, scripts and proxies powered the campaign.

Between late September and early October 2026, seven South Korean financial institutions had data stolen through internet-facing systems. Roughly 66,000 to 67,000 people and about 2,200 companies were affected.

Names, jobs, income details and loan information were exposed. CrowdStrike first tied the activity to ARTEX, an open-source, China-developed AI penetration testing framework.

CrowdStrike judged, with moderate confidence, that a single Chinese-speaking, financially motivated lone operator used ARTEX instead of a known hacking group.

The public reports named one key server at 38.244.50[.]120 and a reseller domain, xcai[.]pro, used to reach AI models. Genians later confirmed the same findings, and the ARTEX GitHub page and Docker image were taken down on October 11, though copies remain online.

Researchers at Hunt.io noted that the public indicators were only part of the picture. While pivoting off the known server, they found a new open directory at 23.248.226[.]250, a Hong Kong jump server that held far more of the operator’s working files.

ARTEX Hackers Expose Their Own Servers, Revealing AI Tools

The Hong Kong server held a state file showing the operator ran Claude Code, version 2.1.221, and had started it 510 times since August 4, 2026. The software was not talking to Anthropic, though.

A router called Claude Code Router, plus small Python helper scripts, sent every request through the xcai[.]pro reseller to DeepSeek. This resembles other cases where Claude Code and DeepSeek were joined in one workflow.

One helper script even carried a note in Chinese describing the route in the operator’s own words. Other files showed a Zhipu AI key for GLM models and a tunnel named grok2api, which fits CrowdStrike’s finding that DeepSeek, GLM and Grok were all in use.

The state file also listed 19 custom “skills,” which are reusable instruction sets for the AI agent, used 147 times in total. They covered reconnaissance, code review, web testing, firewall bypass checks, Android app analysis and cloud phone control.

One skill tested payment logic, and a nearby file held three test accounts for a cash-in deposit service. That setup suggests the operator was checking for insecure direct object reference flaws. These flaws let a user view or change another person’s data by altering an ID.

A credentials file named .secrets was also found, along with a backup copy. A Chinese comment inside it said it was the “sole source of credentials” and warned against pasting passwords into a session.

Three scripts used that same root login to keep a reverse SSH tunnel alive and to copy the AI’s memory files to the jump host.

Wider Tools, Hunting Pivots and Defense

The exposed folders held more than bank-related tools. Hunt.io found a proxy service at 154.201.79[.]246:443 that gave 79 unique exit IP addresses from the first 100 identities tested.

It also found a staged JNDI and LDAP setup for remote code execution, with a DNS callback to confirm success.

Other files included cryptocurrency exchange scripts, Linux privilege escalation exploits and iOS and Android tooling. Hunt.io says the link between these items and the bank breaches is unconfirmed.

Hunt.io then built three ways to find more ARTEX servers. A certificate search returned 19 IP addresses, a malware-tag search returned 1,303, and a search on the console’s page title returned about 1,300.

A separate search for open directories returned 280 results. The tags covered 30 countries, led by the United States, then China and Hong Kong.

This shows the framework is spreading well beyond one case, which matches reports of ARTEX automating enterprise attacks elsewhere.

Defenders should close public access to admin services and place them behind a VPN or allowlist. They should also reset SSH passwords and rotate API keys, proxy logins and tokens that may have sat in exposed files.

Teams should watch for odd LDAP or JNDI traffic, strange DNS callbacks, remote script downloads and unexpected outbound connections.

They should also lock down access to AI model gateways. Later, South Korean police arrested a suspected hacker over a separate case that also involved ARTEX, though the shared tool does not prove the same people were involved.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARTEX Hackers Expose Their Own Servers, Revealing AI Tools Behind South Korean Bank Breaches appeared first on Cyber Security News.