Jannik Malte Meissner

Agentic Speed, Peripheral Weakness: What the South Korean Financial Breaches Reveal About the ARTEX Campaign

One operator used the ARTEX agentic pentesting framework to compromise 16 South Korean financial organisations and extract roughly 100,000 personal records from internet-exposed peripheral systems.

Map of the Korean peninsula with a red network of nodes radiating from a bright central point, titled Agentic Speed, Peripheral Weakness.

Between late September and mid-October 2026 a single operator used the Chinese open-source agentic penetration-testing framework ARTEX, together with multiple large language models, to compromise 16 South Korean financial organisations. Roughly 100,000 personal records were extracted, predominantly resident registration numbers, names, contact details and, in some cases, income or loan-limit data. No evidence of core banking system compromise, credential theft for transactional fraud, or direct fund movement has been reported.

The campaign is notable less for novel exploits than for the speed and parallelism with which an agentic toolset located and abused long-standing weaknesses in internet-exposed supporting systems.

Scope and Affected Systems

Initial public reports covered seven organisations (Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram, Welcome and Hyundai Capital). Subsequent regulator disclosures raised the total to 16, adding private credit firms, electronic-payment providers and cryptocurrency exchanges including Streami (GOPAX) and Prabang. Shinhan’s loan-broker inquiry service alone accounted for approximately 25,700 records. KB Kookmin leaked 119 records from an employee mobile work-support application; Hana leaked 89 from its ODS sales-support system; BNK Busan exposed data on 11 outsourced developers through pages with weak session validation. Later victims included KDB Capital (848 customer records) and smaller crypto-related entities.

Common contributing factors cited by the Financial Services Commission and Financial Security Institute were missing patches, unsupported systems, absence of continuous monitoring, and weak authentication or authorisation controls on externally reachable interfaces.

ARTEX and the Operator’s Toolchain

ARTEX is a multi-agent autonomous penetration-testing system released on GitHub in July 2026 under an AGPL-3.0 licence by the account Autumn-27 (identified in reporting as Li Puhua). It is not itself an LLM; it orchestrates planner and worker agents that connect to external models to perform reconnaissance, vulnerability enumeration, attack-path generation and iterative validation. After the Korean incidents the developer converted the project to closed source and halted public updates; derivative English- and Korean-language forks already exist.

CrowdStrike recovered Claude Code session histories, ARTEX configuration files and memory files from open directories on attacker-controlled infrastructure. The primary ARTEX instance used DeepSeek v4.1-flash (reached via the proxy/reseller xcai[.]pro). Supplementary sessions employed GLM-5.3 (Zhipu AI) and Grok 4.6 under Claude Code, steered by Chinese-language pentesting prompts. A Financial Security Institute official stated explicitly that the AI did not operate independently; a human operator directed the activity. The same infrastructure also contained evidence that the operator queried models about Korean data-sale channels on Telegram and generated a résumé containing identifying details—an operational-security failure that aided attribution. CrowdStrike assesses moderate confidence that the operator is a financially motivated Chinese speaker.

Infrastructure characteristics included rotating sets of two to three overlapping IP addresses per target (blocking one simply caused a switch) and a Hong Kong-based element. Investigators noted a consistent traffic signature associated with ARTEX-originated activity.

Attack Techniques

The operator consistently avoided core payment and customer-facing internet/mobile banking platforms. Instead, the agents targeted internet-exposed peripheral systems used by loan brokers, employees and partners:

  • Enumeration of customer or identifier values against inquiry services after partial bypass of mobile-phone verification steps (Shinhan).
  • Access to employee mobile work-support applications and sales-support systems (KB Kookmin, Hana).
  • Exploitation of insufficient session validation on web pages (BNK Busan).

No public CVEs have been named. Success depended on systems that were reachable from the internet, possessed weak or incomplete authentication, and were incompletely inventoried or monitored. In at least one case the operator obtained valid customer numbers and then queried multiple simple inquiry services to extract associated records. Activity exhibited adaptive timing and infrastructure rotation consistent with agentic control rather than purely scripted credential stuffing. Detection windows reported by affected organisations ranged from 15 to more than 40 hours.

Detection and Response Indicators

Shared indicators included the ARTEX page-title string (“ARTEX—自主渗透测试控制台”) observed on infrastructure linked to the Shinhan activity, consistent traffic signatures, and the specific IP sets distributed by the Financial Security Institute to the wider sector. Subsequent victims were often identified only after organisations reviewed logs for those IPs. The attacker’s own open directories proved more valuable to investigators than many of the victim-side artefacts.

Regulators responded with emergency meetings, mandatory reviews of every externally exposed system, instructions to replace ageing equipment, a requirement for large firms to perform vulnerability checks at least twice yearly, and plans for an AI-based joint security monitoring capability aimed especially at smaller institutions. Whether the simultaneous nature of the campaign will slow planned relaxation of network-separation rules remains an open regulatory question.

Technical Takeaways

Agentic frameworks such as ARTEX compress the traditional reconnaissance-to-exploitation cycle and allow a single operator to test multiple organisations in parallel against the same class of weak peripheral services. The limiting factors in this campaign were not exotic vulnerabilities but incomplete external attack-surface inventories, light authentication on non-core interfaces, and detection logic tuned primarily to core banking traffic. Continuous or high-frequency agentic testing of every internet-reachable path that can return internal data, combined with behavioural detection for high-volume identifier enumeration and multi-IP probing of the same services, would have reduced dwell time. The forensic value of the operator’s own session logs further illustrates that AI-assisted operations generate rich artefacts when operational security is neglected.

This is exactly the problem we built Aspherity to address. We use agentic techniques ourselves to continuously probe and validate external attack surfaces, particularly the peripheral systems that traditional programmes tend to under-prioritise, while also securing the AI agents, LLMs and orchestration layers that organisations are now deploying. If your current testing cadence and detection coverage are still largely shaped by human-scale assessments and core-system assumptions, we would be happy to show you how an AI-native approach changes the tempo and the visibility.

Sources

← Back to blog