South Korean banks hacked: CrowdStrike finds the attacker's Claude Code sessions and Chinese tool ARTEX

Directories left open by the attacker reveal a Chinese agentic pentest tool plugged into DeepSeek, GLM, and Grok. CrowdStrike leans toward a Chinese-speaking actor motivated by money.

CrowdStrike's intelligence teams uncovered the campaign infrastructure that hit several South Korean financial organizations between late September and early October 2026, with data exfiling. On one bank, the intruder reportedly entered a loan request tracking service used by brokers; on another, a mobile assistance system for employees. The total number of victims remains unknown.

Traces left clear

The attacker left accessible directories containing Claude Code session history, memory files and configuration ofARTEX, an open source agent intrusion test tool developed in China and released recently. A Chinese-language instruction file described the course of the slopest. The device was based on two servers, one of which, in Hong Kong, served as the main base; the ARTEX instance used DeepSeek v4.1-flash as its main model, supplemented by GLM-5.3 of Zipu AI and Grok 4.6, with access to DeepSeek likely passing through an API reseller.

The sessions also show the operator asking where to resell Korean banking data and how to find specialized Telegram groups — and even the writing of a CV of security researcher boasting the results of the operation. Without attribution to a known group, CrowdStrike believes with moderate confidence that it is a financial Sinophone actor, and sees it as proof that the agent tooling now allows for several intrusions in a very short time.