An open-source agentic penetration-testing tool called ARTEX was used in a data breach affecting finance firms in South Korea. CrowdStrike reported that an unknown actor paired ARTEX with large language models to target South Korean finance from late September to early October 2026, and follow-up reporting confirmed data theft from banks.
ARTEX is an agentic tool that can probe systems, execute tasks and escalate access with limited manual input. In this incident, it served as the intrusion engine rather than a manual hacking toolkit. The confirmed victims include Shinhan Bank and Yegaram Savings Bank, according to The Hacker News report.
Table of Contents
- Which banks and customers were affected?
- How did attackers enter the banks?
- What tooling powered the operation?
- What should exposed customers do now?
Which banks and customers were affected?
The heaviest exposure fell on two lenders. Press and bank disclosures tallied about 25,729 affected people at Shinhan and about 40,000 at Yegaram, plus 119 at KB Kookmin Bank and 89 at Hana Bank, according to the Cloud Security Alliance Labs research note.
The wider incident touched five to nine institutions. Named targets include Shinhan, KB Kookmin, Hana, BNK Busan and Yegaram, with Welcome Savings Bank and Hyundai Capital appearing in broader counts. Total exposure sits near 65,000 to 68,000 people.
How did attackers enter the banks?
The entry points were peripheral systems, not core banking platforms. Attackers used weakly protected loan-broker portals and an employee mobile work-support system as footholds.
That path matters for customers. Core ledgers and payment switches were not described as breached, but personal information passing through broker and support channels was exposed. Peripheral portals often carry loan applications, contact details and identification documents.
What tooling powered the operation?
The operational setup centered on ARTEX backed by DeepSeek v4.1-flash, with related Claude Code, GLM-5.3 and Grok 4.6 sessions observed. CrowdStrike linked the activity to open directories on Hong Kong IP addresses containing ARTEX configurations and Claude histories, as detailed in the CrowdStrike investigation.
Those exposed files gave investigators a direct view into tooling and workflow. Configuration data showed how models were connected to ARTEX. Stored histories showed prior commands and targeting activity.
What should exposed customers do now?
CrowdStrike assesses with moderate confidence that the operator was a lone Chinese-speaking actor seeking financial gain. Investigators found personal details and searches for Telegram groups to sell stolen data.
South Korean police continue a full investigation. Customers of named banks should act on bank notices first, then limit fraud risk.
- Use the bank's official notice or call center to confirm whether your account was included
- Change passwords for banking, email and loan-portal accounts, and turn on login alerts
- Freeze or closely monitor credit reports for new loans or accounts
- Treat calls, texts and emails claiming to be the bank as suspect and contact the bank directly
You Might Also Like
- Why Two People Affected by the Same Data Breach May Face Different Risks
- Vendor Data Breach Investigation Guide: Evidence, Notices, and Verification
- Tech Company Data Breach News Explained for 2026: Who It Affects, Key Evidence, and What to Do Next