[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMMpvBKS3OE2JHMMBwHWx_0dY3pY1cyQVB8cEe6LLrjU":3},{"article":4,"iocs":55,"watch_terms":67,"solutions":68,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6627591a-1391-448e-a024-ad588d587bf2","Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches","inside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches-162e2e","Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. […]","Hunt.io has traced ARTEX servers and AI-powered hacking tools responsible for data breaches at seven South Korean financial institutions. The attacks, occurring between late September and early October 2026, exposed personal, employment, income, and loan data for approximately 67,000 individuals and 2,200 corporations. The ARTEX framework, an open-source penetration testing tool developed in China, leveraged multiple AI models including DeepSeek and GLM.","ARTEX AI hacking tools used in South Korean bank breaches affecting 67k people and 2.2k corporations.","https:\u002F\u002Fsecurityaffairs.com\u002F202607\u002Fai\u002Finside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-13.png","2026-11-07T19:56:18+00:00","2026-11-07T20:00:25.028383+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"AI Hacking Tools","technology",{"name":24,"type":25},"Hunt.io","vendor",{"name":27,"type":25},"CrowdStrike",{"name":29,"type":25},"Genians",{"name":31,"type":22},"DeepSeek v4.1 Flash","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60,63],{"type":57,"value":58,"context":59},"ip","38.244.50.120","Server hosting the ARTEX console",{"type":57,"value":61,"context":62},"23.248.226.250","Jump server in Hong Kong",{"type":64,"value":65,"context":66},"domain","xcai.pro","Reseller domain used to access AI services",[27,24,29],{"controls":69,"vendors":155},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":100,"name":101,"problem":102,"products":103},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"slug":36,"name":129,"problem":130,"products":131},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[132,140,147],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":141,"vendor_name":27,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[156],{"slug":141,"name":27,"logo_path":142,"roles":157},[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"ai-powered-artex-framework-breaches-seven-south-korean-banks-via-exposed-servers","AI-Powered ARTEX Framework Breaches Seven South Korean Banks via Exposed Servers","The ARTEX attacks highlight the growing danger of AI-augmented open-source penetration testing tools being weaponized against financial institutions with inadequate external attack surface management. Exposed, misconfigured servers provided the entry points attackers needed, compounded by insufficient monitoring of internet-facing assets. The breach of personal, employment, income, and loan data for nearly 70,000 individuals and over 2,000 corporations underscores how operational security gaps in the financial sector carry severe regulatory and reputational consequences. As AI models like DeepSeek and GLM lower the technical barrier for sophisticated attacks, defenders must assume adversaries are iterating faster than ever and harden their environments accordingly.",[164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","GDPR Article 32",{"DORA Article 9":172,"GDPR Article 32":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"CIS Control 12: Network Infrastructure Management":175,"CIS Control 7: Continuous Vulnerability Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"DORA mandates that financial entities implement robust ICT security measures and continuously manage their attack surface, obligations directly relevant to the exposed server configurations that enabled this breach.","The exposure of personal data for approximately 67,000 individuals triggers GDPR Article 32 obligations to implement appropriate technical measures ensuring data security, including access controls and vulnerability management on systems holding that data.","A disciplined flaw remediation process mandates timely patching and configuration hardening of internet-exposed systems, directly addressing the misconfigured servers ARTEX exploited.","Proper network segmentation between publicly accessible servers and sensitive banking data repositories would have constrained the blast radius of the breach.","Regular, automated scanning of internet-facing servers would have identified the exposed ARTEX-targeted attack surfaces before adversaries could exploit them.","This control requires organizations to maintain awareness of technical vulnerabilities in their systems and take timely corrective action, which would have surfaced the exposed server risk before exploitation.","Stronger access controls on exposed servers would have required attackers to overcome additional authentication barriers before reaching sensitive financial data."]