An AI Pentest Kit Turned on Major South Korean Banks: How the Attack Unfolded, Stage by Stage

A tool built to help defenders test their own networks has been used in attacks on several major South Korean banks. CrowdStrike researchers say a Chinese-speaking attacker leaned on an AI-driven penetration testing suite called ARTEX AI, plus Claude coding agents, to run the operation, and then left a surprising amount of evidence lying around.

We’ve laid out the sequence below using Bill Toulas’s reporting at BleepingComputer.

Stage 1: An open-source testing tool

ARTEX AI was, until recently, an open-source agentic penetration testing suite developed in China. Tools like this automate much of the work a human tester would do when probing a network for weaknesses.

Stage 2: The tool is pointed at banks

Earlier this month, attacks hit multiple Korean banks, including Shinhan Bank, KB Kookmin Bank and Hana Bank. Customers’ personal data and credit card information were exposed, and some systems suffered outages.

Stage 3: The government responds

South Korea’s government called an emergency meeting and urged immediate security measures for critical IT systems.

Stage 4: Researchers find the attacker’s workspace

CrowdStrike confirmed ARTEX AI had been used after locating the attacker’s infrastructure. Open directories on those servers held Claude Code session histories, ARTEX configuration files and Claude memory files. The ARTEX setup ran on DeepSeek as its main language model, with other models used for additional Claude Code sessions, and the researchers believe DeepSeek was reached through an API reseller. Targets in the records matched banks named in earlier reports on the financial-sector breaches, which let CrowdStrike link the activity with high confidence.

Stage 5: The AI tools give the attacker away

The attacker also used the same AI tools to write a résumé, exposing identification, contact and Telegram details. Those suggest the attacker may be a 26-year-old Chinese national who studied at the South China University of Technology and lives in Maoming, Guangdong. CrowdStrike cautions that the details don’t line up perfectly, since a birth year of 2007 appeared at first, so they can’t confirm the person’s identity.

Stage 6: No clear plan for the stolen data

The records suggest the attacker hadn’t worked out how to make money from the data. At one point they asked Claude to suggest Telegram groups that trade Korean data.

Stage 7: The developer shuts the project, but copies live on

Once it was confirmed that ARTEX had been used in real attacks, its developer made the project closed-source and stopped updating it. Its existing code had already been turned into English and Korean versions, though, so the tool remains available.

What this means for your company

This case shows how AI tools lower the skill needed to run a serious intrusion. An attacker with no plan for the stolen data still managed to breach major banks. Smaller businesses should expect more automated probing, faster.

Patch and harden internet-facing systems quickly. Automated tools find the easy openings first.
Run your own regular vulnerability scans and penetration tests so you find weaknesses before someone else’s AI does.
Watch for unusual data movement, such as large exports from customer or payment systems, and alert on it.
Limit who and what can reach sensitive data, and require MFA for every remote and administrative login.
Set rules for AI tools inside your company, including which ones staff may use and what data they can be given.

Need help testing your defenses against the kind of automated, AI-assisted attacks now hitting even large banks? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.