CrowdStrike links ARTEX and Claude Code artifacts to data theft at South Korean financial firms

CrowdStrike says it found an ARTEX instance and an open directory on the server 38.244.50[.]120, including a CLAUDE.md file with a Chinese-language penetration-testing prompt. That file pointed to a Hong Kong server, where further open directories held Claude Code session histories, ARTEX configuration files and memory files covering late September to early October. CrowdStrike writes that "The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions," and that the actor likely reached DeepSeek through a likely API reseller, xcai[.]pro. It also reports that the actor "asked Claude where threat actors typically sell Korean data breach information" and for help finding Korean Telegram data-sale groups. CrowdStrike names no victim; it says the targeted organizations overlap with industry reporting and that the number affected "remains unconfirmed." (CrowdStrike)

The report does not say how the actor obtained Claude Code, whether Anthropic accounts were used, or which model answered the requests it attributes to "Claude." Its own sentence places GLM-5.3 and Grok 4.6 inside "additional Claude Code sessions," so at least some sessions ran Anthropic's coding tool on other companies' models. Whether any Anthropic model processed intrusion or data-sale requests is not established in the public record. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated. It found personal details in one prompt but says it "cannot definitively associate these details with the threat actor"; a man reached by Reuters at the listed phone number said he had no knowledge of the matter. (CrowdStrike; Reuters via BusinessDay)

Korean evidence came first. On October 2, Genians Security Center reported the string "ARTEX-自主渗透試控制台" (Chinese for an autonomous penetration-test console) in the HTML titles of web servers used in the attacks. An anonymous Financial Security Institute official told Herald Business that tracing Shinhan Bank's logs and attacker IP addresses showed ARTEX traces, and added (our translation of the Korean) "It is true that the attack used AI, but the AI did not attack on its own without human involvement." Financial authorities told Korean media on October 5 that the same attacker's IP addresses turned up across the seven firms' incidents; the IPs used against the commercial banks differed from those used against the savings banks and Hyundai Capital, but the methods were similar. Woori Bank and NH NongHyup Bank reported blocked attempts with no data loss. (Kyunghyang, October 2; Kyunghyang, October 4; Herald Business; Nocut News; Korea JoongAng Daily)

Operator writing Chinese-language prompts (identity unconfirmed)
   |
   v
Claude Code sessions + CLAUDE.md pentest prompt        Models named by CrowdStrike:
ARTEX instance on 38.244.50[.]120  ------------------>  DeepSeek v4.1-flash (ARTEX backend, likely via reseller xcai[.]pro)
Hong Kong server as main infrastructure                 GLM-5.3 and Grok 4.6 (other Claude Code sessions)
   |                                                    [which model handled the "Claude" requests: not stated]
   v
Proxy infrastructure reported by CrowdStrike: 9 addresses in the ARTEX investigation
Separate FSS count reported by the press: 28 addresses in 12 countries across the broader inquiry
[the overlap between these two sets is not published]
   |
   v
Side systems at banks and lenders: loan-broker inquiry pages, employee mobile
work systems, a sales-support system, and a homepage with known flaws
   |
   v
Reported paths: unauthenticated or bypassable look-ups; missing device controls
or unpatched web flaws; known vulnerabilities followed by malware-assisted log theft
   |
   v
[attributed to CrowdStrike only] the operator asks where Korean breach data is sold; no sale confirmed

The exploited weaknesses were in systems operated by the affected firms. Financial authorities sorted the cases into three types (our translation of the Korean): inquiry services built so that loan applications or company-representative details could be looked up without identity checks; employee work-support services with missing mobile-device access control or unfixed web flaws; and a homepage where the attacker used known vulnerabilities to install malware and take log files containing customer data. Shinhan's leak came through a loan-broker inquiry service that needed no certificate login. The FSC's own summary names "systems used by employees and by outside personnel such as loan brokers and contractors" as the cause (our translation). (Nocut News; YTN; FSC, October 4 meeting)

How the attacker found valid records is described differently. Kyunghyang reports that the attackers fed random values into Shinhan's broker service to find valid customer numbers; YTN and Weekly Kyunghyang describe brute-force or credential-stuffing logins; Shinhan's account, as relayed by MTN, says access came through "an abnormal method that bypasses authentication" (our translation). The Financial Security Institute official said the attacker "did not take over the systems" but pulled data through look-ups (our translation). Banks with layered authentication, such as Woori and NH NongHyup, turned the same attempts away. (Kyunghyang; Weekly Kyunghyang; MTN; Herald Business)

The second boundary concerns coding-agent sessions and model backends that CrowdStrike says were used during the activity, including requests about where stolen Korean data is sold. The public report does not identify which model handled those requests, whether any model refused, whether provider safeguards applied, how the actor paid for or obtained access, or whether every backend was reached through its named provider. Hunt.io later reported that one exposed Claude Code configuration routed through Claude Code Router and xcai to DeepSeek rather than directly to the Anthropic API. A provider-safeguard failure is therefore not established. How much of each intrusion ARTEX automated, versus the operator, is also unknown; Weekly Kyunghyang notes that this remains for the police to determine. (CrowdStrike; Hunt.io; Weekly Kyunghyang)

People whose data was taken face targeted phishing risk: the leaked Shinhan records pair names and phone numbers with income and loan limits, which regulators warned could make fake loan calls convincing. The FSC and FSS issued a consumer alert on October 6, which PIPC also posted, and set a one-month special response period with dedicated help desks and stepped-up fraud monitoring of affected customers. On November 6 the FSC said no cases of customer funds lost to voice phishing or smishing linked to the leaks had been reported, and it extended the special period to the end of December. (FSC alert; FSC, November 6)

Affected firms shut the exposed services and blocked attacker IPs. No attack-caused outage of customer banking was found in the sources reviewed; BleepingComputer's mention of outages is not supported by the official statements read. Its report of exposed "credit card information" at KB Kookmin also conflicts with KB's own description relayed by iNews24 and with the FSC's October 14 finding that no account passwords or card numbers had leaked; CEO Score reports credit grades and overdue revolving-credit principal among KB's leaked fields. (BleepingComputer; iNews24; CEO Score Daily; FSC, October 14)

The regulator ordered checks across the sector. By October 8, 555 firms had completed a 12-item checklist and 130 reported shortcomings, mostly missing patches and monitoring gaps. On November 5 the FSC announced a full review of external access points at about 580 firms, more frequent vulnerability assessments for large firms, and a planned Digital Financial Safety Act bill (our translation of the Korean name) for the first quarter of 2027. The ARTEX developer stopped public releases, though earlier copies remain in circulation. (FSC, October 14; FSC, November 5; Korea JoongAng Daily)

The FSC's later totals cover a broader wave. Its 16-firm list of October 14 adds DB Savings Bank, OK Savings Bank, KDB Capital, PFCT, Mouda, Brightfix, Streami, Prabang and the Korean Federation of Community Credit Cooperatives to the first seven. By November 3, 37 firms had reported 40 incidents with about 473,000 leaked records, and small crypto exchanges, electronic-finance firms and online lenders reported about 1 billion won in company-held funds stolen. The FSC attributes none of these totals to the ARTEX actor, and this record does not count them as its impact. (FSC, October 14; FSC, November 5)

Anthropic. No Anthropic statement on this case was found on its newsroom or threat-intelligence page, or in news searches through November 6. Reuters reported on October 8 that Anthropic did not immediately respond to a request for comment. No report of account bans tied to this case was found. (Reuters via BusinessDay; Reuters via Taipei Times)

DeepSeek, Zhipu AI, xAI and the reseller. No statement from DeepSeek, Zhipu AI or xAI about this case, and none from the operator of xcai[.]pro, was found in searches through November 6.

ARTEX developer. The developer said on October 8, in Reuters' translation, that because of "misuse of the tool" the project "will no longer be updated and will be converted to closed source." Reuters says the statement did not directly address the bank attacks. (Reuters via The Straits Times)

CrowdStrike. Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told reporters the case "allows one human to target many customers in a very short period of time using the power of AI." (Reuters via Taipei Times)

Affected firms. Shinhan Bank apologized, opened a lookup page for customers to check exposure and said it would compensate any loss in full. KB Kookmin and Hana told customers how to claim damages. Yegaram Savings Bank apologized and said it had blocked external IPs and suspended the service. These statements were read through Korean press, not on the firms' own sites. (MTN; CEO Score Daily; iNews24)