CrowdStrike says an AI pentest agent hit Korean banks

The attack agent was open source and its model was swappable. That's the news.

CrowdStrike reported on Wednesday that an unidentified actor used ARTEX against South Korean financial organizations from late September to early October. CrowdStrike describes ARTEX as a recently released, open-source agentic penetration testing tool developed in China.

What CrowdStrike says happened

Citing industry reporting, CrowdStrike says the actor:

• breached a loan progress inquiry service that financial brokers use at one bank,
• and compromised an employee mobile work-support system at another bank.

From its own look at the attacker's server, CrowdStrike says the actor ran ARTEX with a Chinese-language pentesting prompt in a Claude Code configuration file, and moved among several models and proxies across Claude Code sessions.

The main backend was DeepSeek v4.1-flash, likely reached through an API reseller, CrowdStrike says. GLM-5.3 from Zhipu AI and Grok 4.6 appeared in other sessions.

The actor also asked Claude where Korean breach data is typically sold, and for help finding Korean Telegram groups that sell such data, per CrowdStrike.

CrowdStrike assesses with moderate confidence that the actor is a financially motivated Chinese speaker. It has not tied the activity to a named group.

Industry reporting says several organizations had data breaches, CrowdStrike notes. The count is unconfirmed.

The model was the replaceable part

For two years the misuse debate has centered on what one lab's model will refuse.

This case cuts across that. The attacker kept the harness and changed the engine underneath it, through proxies and resellers.

A single lab's guardrails still matter. They stop the attacker who has one option. This one had several.

What the agent adds is speed. CrowdStrike says AI tooling let this actor run multiple intrusions in a short period, and that adversaries will likely keep experimenting with it to raise their operational tempo.

What defenders can use now

CrowdStrike's post lists indicators of compromise, including the server that hosted the ARTEX instance and nine proxy IP addresses, plus MITRE ATT&CK mappings. If you run security at a financial firm, load them today.

Defenders got new tools this week too. Anthropic launched its Cyber Mission on Thursday, including OSS Scanner, a free, opt-in scanner for core maintainers of critical open-source projects. Anthropic says the reports go out without human review, and it expects a true-positive rate above 90%. That follows the three-tier cyber access program Anthropic set up earlier in the week.

For everyone else, the step is unglamorous. Inventory the internet-facing services nobody owns. A broker's loan-status lookup is exactly that kind of service.

Then close the gap between a patch shipping and a patch applied, because an agent doesn't get tired of scanning.

Watch the victim count

Neither CrowdStrike nor the reporting it cites has confirmed how many organizations were hit. That number, and whether ARTEX turns up in other countries' incident reports, will say whether this was one crew or the start of a pattern.

Patch faster. Then find what you forgot you exposed.