Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches
ARTEX AI hacking tools used in South Korean bank breaches affecting 67k people and 2.2k corporations.
Run CrowdStrike?
Get an email when a reviewed story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Hunt.io has traced ARTEX servers and AI-powered hacking tools responsible for data breaches at seven South Korean financial institutions. The attacks, occurring between late September and early October 2026, exposed personal, employment, income, and loan data for approximately 67,000 individuals and 2,200 corporations. The ARTEX framework, an open-source penetration testing tool developed in China, leveraged multiple AI models including DeepSeek and GLM.
The lesson from this incident
Full lessonThe ARTEX attacks highlight the growing danger of AI-augmented open-source penetration testing tools being weaponized against financial institutions with inadequate external attack surface management. Exposed, misconfigured servers provided the entry points attackers needed, compounded by insufficient monitoring of internet-facing assets. The breach of personal, employment, income, and loan data for nearly 70,000 individuals and over 2,000 corporations underscores how operational security gaps in the financial sector carry severe regulatory and reputational consequences. As AI models like DeepSeek and GLM lower the technical barrier for sophisticated attacks, defenders must assume adversaries are iterating faster than ever and harden their environments accordingly.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- ip — 38.244.50.120
- ip — 23.248.226.250
- domain — xcai.pro