ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks

A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations.

Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026.

CrowdStrike’s October 7 investigation assessed with moderate confidence that the operator was Chinese-speaking and financially motivated.

The activity remains unattributed to a named threat group. Compromised systems reportedly included a loan progress inquiry service for financial brokers and an employee mobile work-support platform, although initial access techniques remain undisclosed.

Recovered credential files and shell scripts directly reference 38.244.50[.]120, the ARTEX server previously identified by CrowdStrike.

The strongest linkage comes from a .secrets file identifying 38.244.50[.]120 as JUMPHOST, alongside root-account credentials and API access fields.

Hunt.io’s investigation expands, the infrastructure picture through an exposed directory at 23.248.226[.]250:18099, a Hong Kong-based host containing 42 files across two subdirectories.

AI-Powered Banking

Three supporting scripts, local-boot.sh, tunnel-watchdog.sh, and sync-memory.sh, use sshpass for remote operations, maintaining reverse SSH tunnels and synchronizing Markdown memory files between systems.

These artifacts expose infrastructure administration and agent memory handling, not just a deployed attack console.

Recovered .claude.json metadata identifies Claude Code as the agent harness, with 510 recorded startups and 19 custom skills totaling 147 invocations.

Crucially, its presence does not establish that Anthropic’s models powered the activity: the recovered routing components instead reference alternative providers.

CrowdStrike identified DeepSeek v4.1-flash as ARTEX’s primary backend, supplemented by GLM-5.3 and Grok 4.6 in additional Claude Code sessions.

Requests likely passed through xcai[.]pro, an API proxy or reseller associated with the campaign.

Hunt.io’s supplied findings describe ds-models-shim.py, which substitutes a local model listing for an incompatible discovery endpoint, and xcai-effort-shim.py, which injects a reasoning_effort parameter into outgoing requests.

Together, these components demonstrate deliberate adaptation of the agent interface to nonstandard model backends.

Custom skills covered reconnaissance, source auditing, JavaScript API discovery, authentication testing, firewall bypass, payment logic, and Android cloud-phone operations.

Their presence establishes configured capabilities, not proof that every workflow was executed against Korean institutions.

Recovered proxy-enumeration scripts targeted 154.201.79[.]246:443, an address independently listed in CrowdStrike’s indicators.

Hunt.io’s initial sample reportedly identified 79 unique exit addresses across 100 tested identities, illustrating how one authenticated endpoint could support distributed traffic origins.

A separate directory on the Hong Kong host exposed a staged JNDI/LDAP exploitation setup. Java naming references pointed toward a hosted exploit class designed to execute system-identification commands and transmit results through DNS callbacks.

Its recovery indicates prepared execution-validation tooling; it does not independently establish exploitation of a particular bank.

Additional files included cryptocurrency withdrawal-related scripts, Linux privilege-escalation builds, iOS research code, and Android firmware utilities. Their relationship to the banking breaches remains unconfirmed.

Defenders can pivot on ARTEX console titles, certificate metadata, and published infrastructure indicators, but matching deployments should not automatically be attributed to this operator.

The Cloud Security Alliance cautions that neither full attack autonomy nor reconciled victim totals is established.

Priorities include reviewing peripheral application access, enforcing server-side authorization, and investigating unexplained outbound connections to model resellers and proxy services.

IOCs

Indicator	Type	Context
38.244.50[.]120	IPv4 address	ARTEX console host and SSH tunnel destination referenced in recovered configuration
23.248.226[.]250	IPv4 address	Hong Kong jump host with exposed directories and supporting tooling
154.201.79[.]246	IPv4 address	Proxy service used by proxy enumeration scripts; also reported by external sources cited in the draft
xcai[.]pro	Domain	AI service reseller domain associated with the reported campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.