South Korea Bank Hack: How ARTEX, LLMs and Claude Code Sessions Exposed the Attacker

Last week, several of South Korea's largest financial organizations reported data breaches. On October 7, 2026, CrowdStrike Intelligence published Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, saying the campaign was probably run by one person using an open-source agentic pentesting tool called ARTEX plus a rotating set of LLMs, including Claude Code. What gave the actor away was not a sophisticated defender. It was an open web directory on his own server.

This post summarizes what CrowdStrike reported about the South Korea bank cyberattack, separates what is confirmed from what is assessed, and pulls out what matters for anyone running AI coding agents. Everything attributed to the campaign below comes from CrowdStrike's report and the news coverage it cites; Beam has no independent visibility into these incidents.

TL;DR: the South Korea bank hack at a glance

How the attack worked

According to industry reports cited by CrowdStrike, the attacker went after two kinds of internal-facing systems: a loan progress inquiry service that brokers use to check on applications, and a mobile work-support system for bank employees. Activity at several organizations reportedly involved overlapping IP addresses, which is part of why investigators suspected a single operator.

The ARTEX link came from HTML files on a reportedly attacker-controlled server that referenced the string "ARTEX". CrowdStrike then followed that infrastructure to an IP address, 38.244.50[.]120, which hosted an ARTEX instance and a browsable directory.

What ARTEX is

ARTEX is an agentic penetration-testing tool: instead of a human stepping through a scanner, an LLM is given a goal and a system prompt, and it chooses and runs the tooling itself. Pentesting agents are legitimate security tools. The same property that makes them useful for red teams — they chain recon, exploitation and follow-up with little supervision — shortens the time an attacker needs per target.

CrowdStrike's assessment is blunt about the effect: the activity "demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span."

The two-server layout

Claude Code sessions recovered from the exposed directories show two servers with different jobs:

1. A Hong Kong–based IP address served as the attacker's primary infrastructure, and hosted additional open directories with Claude Code session histories, ARTEX configuration files and Claude memory files.
2. 38.244.50[.]120 hosted the ARTEX instance that was likely responsible for the Korean attacks.

The ARTEX instance used DeepSeek v4.1-flash as its main LLM backend. The actor added GLM-5.3 and Grok 4.6 for further Claude Code sessions, and likely reached DeepSeek through an LLM API proxy or reseller, xcai[.]pro. A Chinese-language pentesting prompt in /.claude/CLAUDE.md told the model how to conduct the testing.

The operational security mistake

Directory listing was enabled on a server that held the actor's working files. That one setting exposed:

• CLAUDE.md — standing instructions that shaped how the agent behaved, including the pentesting prompt.
• Session histories — the full conversation and tool-call record, which is why CrowdStrike could reconstruct the campaign timeline.
• Memory files — what the agent had been told to remember between sessions.
• ARTEX configuration — how the tool was wired to its model backends.

Per CrowdStrike, the sessions also show the actor asking Claude where threat actors typically sell Korean data breach information and for help finding Korean Telegram data-sales groups, and asking Claude to draft a security-researcher résumé that cited the ARTEX activity as results. That résumé prompt contained personal details that CrowdStrike says likely belong to the operator but cannot definitively tie to him. Because those details are unconfirmed and relate to a private individual, this post does not repeat them.

Indicators of compromise

CrowdStrike lists these network indicators. Defenders at financial institutions may want to check them against logs; they are listed defanged.

CrowdStrike maps the activity to MITRE ATT&CK techniques T1583.003 (Acquire Infrastructure: Virtual Private Server), T1588.007 (Obtain Capabilities: Artificial Intelligence) and T1090 (Proxy).

What this means if you run AI coding agents

The story is about an attacker, but three lessons apply to ordinary users of Claude Code, Codex and similar agents.

1. Agent session data is a rich, sensitive artifact

A session history is a complete record of intent, commands, file contents and sometimes credentials pasted into prompts. In this case it let a third party rebuild a campaign. In your case it could reveal internal hostnames, tokens or customer data. Treat ~/.claude, project CLAUDE.md files and memory files like you treat shell history and .env files: never serve them over HTTP, never commit them to public repositories, and never leave directory listing on for a path that contains them.

2. Agents lower the cost of scale

CrowdStrike expects adversaries "will likely continue to experiment with implementing AI tooling in their operations to enhance their operational tempo and capabilities." That matches the pattern in Anthropic's September 2026 threat intelligence report and cases such as ShinyHunters-style vibe hacking. Defenders should assume more attempts per attacker, not smarter individual exploits.

3. Know what your own agents are doing

The flip side of attackers using agents is that your own agents can be steered or misused too — see AI agent security incidents: a timeline and agents harvesting credentials into a loot folder. A local record of tool calls makes it possible to answer "what did the agent actually run?" after the fact. That is the job of AI agent monitoring, and the trade-offs between watching and blocking are covered in monitor vs. block.

What Beam can and cannot do here

Beam is a local, privacy-first console that watches coding agent activity and flags actions such as credential exposure and destructive commands. Stated plainly:

• Beam does not detect ARTEX or stop attackers. It watches agents on your own machine; it has no view of an attacker's infrastructure or of bank-side intrusions.
• It is relevant to the exposure lesson. Beam stores events as local NDJSON in a directory with mode 0700, redacts known credential formats before writing to disk, and sends nothing off-device by default. It does not protect you if you separately publish your own files with a web server.
• Enforcement is limited. Workspace enforce denies matching Claude Code and Codex tool calls through hooks; it is not a kernel sandbox, and missing or expired cached policy is fail-open.

For practical hardening of your own setup, see stopping dangerous commands in Claude Code and the MCP security practical guide.

Frequently asked questions

What happened in the South Korean bank cyberattack?

Beginning in late September 2026, several South Korean financial organizations suffered data breaches. Industry reporting says one attacker breached a loan progress inquiry service used by financial brokers at one bank, and an employee mobile work-support system at another. The number of affected organizations is still unconfirmed.

What is ARTEX?

ARTEX is a recently released, open-source agentic penetration testing tool developed in China. CrowdStrike says the threat actor ran an ARTEX instance backed by LLMs, with DeepSeek v4.1-flash as the primary model.

How was the attacker's activity discovered?

CrowdStrike found open web directories on attacker-controlled servers. They exposed a Claude Code CLAUDE.md file, session histories, ARTEX configuration files and Claude memory files, which documented the campaign from late September to early October 2026.

Has the attacker been identified?

Not definitively. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated, but has not attributed the activity to a named adversary. Personal details in one prompt likely belong to the actor, but CrowdStrike says current information cannot definitively associate them with him.

Does this mean Claude Code is unsafe to use?

No. Claude Code was one of several tools the actor used, alongside ARTEX and other LLMs. The lesson for ordinary users is about the data agents accumulate — session histories, memory files, prompts — and what happens when a directory holding it is served publicly.

Details reflect CrowdStrike Intelligence's report published October 7, 2026, and news coverage it cites, as of October 8, 2026. Attribution and the number of affected organizations may change as investigations continue.